Pritunl 1.29.2145.25 allows attackers to enumerate valid VPN usernames via a series of /auth/session login attempts. Initially, the server will return error 401. However, if the username is valid, then after 20 login attempts, the server will start responding with error 400. Invalid usernames will receive error 401 indefinitely. Note: This has been disputed by the vendor as not a vulnerability. They argue that this is an intended design
References
| Link | Resource |
|---|---|
| https://github.com/lukaszstu/pritunl/blob/master/CVE-2020-25200 | Exploit Third Party Advisory |
| https://pritunl.com | Vendor Advisory |
| https://pritunl.com/security | Vendor Advisory |
| https://github.com/lukaszstu/pritunl/blob/master/CVE-2020-25200 | Exploit Third Party Advisory |
| https://pritunl.com | Vendor Advisory |
| https://pritunl.com/security | Vendor Advisory |
Configurations
History
21 Nov 2024, 05:17
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/lukaszstu/pritunl/blob/master/CVE-2020-25200 - Exploit, Third Party Advisory | |
| References | () https://pritunl.com - Vendor Advisory | |
| References | () https://pritunl.com/security - Vendor Advisory |
07 Nov 2023, 03:20
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | Pritunl 1.29.2145.25 allows attackers to enumerate valid VPN usernames via a series of /auth/session login attempts. Initially, the server will return error 401. However, if the username is valid, then after 20 login attempts, the server will start responding with error 400. Invalid usernames will receive error 401 indefinitely. Note: This has been disputed by the vendor as not a vulnerability. They argue that this is an intended design |
Information
Published : 2020-10-01 18:15
Updated : 2024-11-21 05:17
NVD link : CVE-2020-25200
Mitre link : CVE-2020-25200
CVE.ORG link : CVE-2020-25200
JSON object : View
Products Affected
pritunl
- pritunl
CWE
CWE-203
Observable Discrepancy