CVE-2022-33737

The OpenVPN Access Server installer creates a log file readable for everyone, which from version 2.10.0 and before 2.11.0 may contain a random generated admin password...

CVE-2022-33738

OpenVPN Access Server before 2.11 uses a weak random generator used to create user session token for the web portal...

CVE-2022-33737

The OpenVPN Access Server installer creates a log file readable for everyone, which from version 2.10.0 and before 2.11.0 may contain a random generated admin password...

CVE-2022-33738

OpenVPN Access Server before 2.11 uses a weak random generator used to create user session token for the web portal...

CVE-2022-33737

The OpenVPN Access Server installer creates a log file readable for everyone, which from version 2.10.0 and before 2.11.0 may contain a random generated admin password...

Default credentials

The OpenVPN Access Server installer creates a log file readable for everyone, which from version 2.10.0 and before 2.11.0 may contain a random generated admin password...

Design/Logic Flaw

OpenVPN Access Server before 2.11 uses a weak random generator used to create user session token for the web portal...

CVE-2022-33738

OpenVPN Access Server before 2.11 uses a weak random generator used to create user session token for the web portal...

CVE-2022-33738

The CVE-2022-33738 entry concerns OpenVPN Access Server prior to version 2.11, where a weak random generator is used to create user session tokens for the web portal. This weak RNG could potentially compromise session tokens, impacting authentication for the portal. The connected sources corrobor...

CVE-2022-33737

Summary: CVE-2022-33737 affects OpenVPN Access Server installers. The issue arises because the installer creates a log file that is readable by everyone, and in OpenVPN Access Server versions 2.10.0 through 2.10.x (up to but not including 2.11.0) this log may contain a randomly generated administ...

CVE-2022-33737

The OpenVPN Access Server installer creates a log file readable for everyone, which from version 2.10.0 and before 2.11.0 may contain a random generated admin password...

OpenVPN log information leakage vulnerability

OpenVPN is a software package from US-based OpenVPN Inc. for creating encrypted tunnels for virtual private networks VPNs, which uses the OpenSSL library to encrypt data and control information, and allows created VPNs to be authenticated using public keys, electronic certificates, or...

CVE-2022-33738: Insufficient Entropy

OpenVPN Access Server before 2.11 uses a weak random generator used to create user session token for the web portal...

CVE-2021-4234: Insufficient Control of Network Message Volume (Network Amplification)

OpenVPN Access Server 2.10 and prior versions are susceptible to resending multiple packets in a response to a reset packet sent from the client which the client again does not respond to, resulting in a limited amplification attack...

CVE-2022-33737: Incorrect Ownership Assignment

The OpenVPN Access Server installer creates a log file readable for everyone, which from version 2.10.0 and before 2.11.0 may contain a random generated admin password...

PT-2022-21854

Name of the Vulnerable Software and Affected Versions OpenVPN Access Server versions prior to 2.11 Description The issue concerns a weak random generator used to create user session tokens for the web portal. This weakness can potentially be exploited, although specific details about real-world...

OpenVPN security feature vulnerability

OpenVPN is a software package for creating encrypted tunnels for virtual private networks VPNs from US-based OpenVPN, which uses the OpenSSL library to encrypt data and control information and allows created VPNs to be authenticated using a public key, e-certificate, or username/password. A...

OpenVPN security vulnerabilities

OpenVPN is a software package for creating encrypted tunnels for Virtual Private Networks VPNs from US-based OpenVPN, which uses the OpenSSL library to encrypt data and control information, and allows created VPNs to be authenticated using public keys, electronic certificates, or...

PT-2022-11589

Name of the Vulnerable Software and Affected Versions OpenVPN Access Server versions 2.10 and prior Description The issue allows for a limited amplification attack by resending multiple packets in response to a reset packet sent from the client, which the client does not respond to. Recommendatio...

PT-2022-21853 · Openvpn · Openvpn Access Server

Name of the Vulnerable Software and Affected Versions: OpenVPN Access Server versions 2.10.0 through 2.10.x and versions prior to 2.11.0, can be simplified to: OpenVPN Access Server versions 2.10.0 through 2.11.0, but since 2.11.0 is not included, it is more accurate to say: OpenVPN Access Server...