CVE-2014-9104

EUVD-2014-8930
Multiple cross-site request forgery (CSRF) vulnerabilities in the XML-RPC API in the Desktop Client in OpenVPN Access Server 1.5.6 and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) disconnecting established VPN sessions, (2) connect to arbitrary VPN servers, or (3) create VPN profiles and execute arbitrary commands via crafted API requests.
CSRF
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.8 UNKNOWN
NETWORK
MEDIUM
AV:N/AC:M/Au:N/C:P/I:P/A:P
Base Score
CVSS 3.x
EPSS Score
Percentile: 45%
Affected Products (NVD)
VendorProductVersion
openvpnopenvpn_access_server
𝑥
≤ 1.5.6
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://openvpn.net/index.php/access-server/security-advisories.html
http://seclists.org/fulldisclosure/2014/Jul/76
http://www.securityfocus.com/archive/1/532795/100/0/threaded
https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20140716-1_OpenVPN_Access_Server_Desktop_Client_Remote_Code_Execution_via_CSRF_v10.txt
https://www.youtube.com/watch?v=qhgysgfvQh8
http://openvpn.net/index.php/access-server/security-advisories.html
http://seclists.org/fulldisclosure/2014/Jul/76
http://www.securityfocus.com/archive/1/532795/100/0/threaded
https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20140716-1_OpenVPN_Access_Server_Desktop_Client_Remote_Code_Execution_via_CSRF_v10.txt
https://www.youtube.com/watch?v=qhgysgfvQh8