CVE-2017-5868

2017-05-2519:00:00

mitre

www.cve.org

6.4 Medium

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

70.8%

JSON

CRLF injection vulnerability in the web interface in OpenVPN Access Server 2.1.4 allows remote attackers to inject arbitrary HTTP headers and consequently conduct session fixation attacks and possibly HTTP response splitting attacks via “%0A” characters in the PATH_INFO to session_start/.