VulnerabilityModified
CVE-2021-3824
OpenVPN Access Server 2.9.0 through 2.9.4 allow remote attackers to inject arbitrary web script or HTML via the web login page URL.
MEDIUM 6.1EPSS 0.75%
Does this matter?
Lower severity and a low EPSS score (0.75%). Track it; it rarely justifies an emergency change on its own.
Description
OpenVPN Access Server 2.9.0 through 2.9.4 allow remote attackers to inject arbitrary web script or HTML via the web login page URL.
- CVSS 3.1
- 6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- EPSS
- 0.75% probability · 53th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-84, CWE-79
- Affected
- openvpn/openvpn access server
- Source
- security@openvpn.net
References
- https://openvpn.net/vpn-server-resources/release-notes/#openvpn-access-server-2-9-5Release Notes, Vendor Advisory
- https://openvpn.net/vpn-server-resources/release-notes/#openvpn-access-server-2-9-5Release Notes, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.