PT-2014-8831
CVE-2014-9104
·
تاريخ النشر
2014-11-26
·
تاريخ التحديث
2018-10-09
الوصف من
CVSS 2.0
6.8
متوسطةالمقاييسAV:N/AC:M/Au:N/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions
OpenVPN Access Server versions 1.5.6 and earlier
Description
The issue affects the XML-RPC API in the Desktop Client, allowing remote attackers to hijack administrator authentication. This can lead to various malicious actions, including disconnecting established VPN sessions, connecting to arbitrary VPN servers, creating VPN profiles, and executing arbitrary commands, all via crafted API requests.
Recommendations
For OpenVPN Access Server versions 1.5.6 and earlier, update to a version later than 1.5.6 to resolve the issue. As a temporary workaround, consider restricting access to the XML-RPC API to minimize the risk of exploitation. Avoid using the API for critical operations until the issue is resolved.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾