CVE-2010-3902

2010-10-1405:58:42

CWE-200

[email protected]

web.nvd.nist.gov

openconnect

cve-2010-3902

webvpn

vulnerability

debugging output

remote attackers

sensitive information

openconnect-devel mailing list

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

6 Medium

AI Score

Confidence

Low

0.004 Low

EPSS

Percentile

73.4%

JSON

OpenConnect before 2.26 places the webvpn cookie value in the debugging output, which might allow remote attackers to obtain sensitive information by reading this output, as demonstrated by output posted to the public openconnect-devel mailing list.

Affected configurations

NVD

Node

infradeadopenconnectRange≤2.25

infradeadopenconnectMatch1.00

infradeadopenconnectMatch1.10

infradeadopenconnectMatch1.20

infradeadopenconnectMatch1.30

infradeadopenconnectMatch2.22

CPENameOperatorVersion
infradead:openconnectinfradead openconnectle2.25
infradead:openconnectinfradead openconnecteq1.00
infradead:openconnectinfradead openconnecteq1.10
infradead:openconnectinfradead openconnecteq1.20
infradead:openconnectinfradead openconnecteq1.30
infradead:openconnectinfradead openconnecteq2.22

CPE	Name	Operator	Version
infradead:openconnect	infradead openconnect	le	2.25
infradead:openconnect	infradead openconnect	eq	1.00
infradead:openconnect	infradead openconnect	eq	1.10
infradead:openconnect	infradead openconnect	eq	1.20
infradead:openconnect	infradead openconnect	eq	1.30
infradead:openconnect	infradead openconnect	eq	2.22