CVE-2017-5868

EPSS 4.6%

Vexday Risk Score

18Baixo

Decisão SSVC (CISA)

Attend

PoC disponível → acompanhar de perto

Maturidade do exploit

Exploit funcional

Exploit automatizável disponível (Nuclei/Metasploit).

CVSS —EPSS 4.6%KEV nãoPoC —Nuclei simMetasploit —Patch —

Ciclo de vida

25 mai 2017Publicada no NVD

Recomendação: Planejar correção próxima — já existe PoC pública.

CRLF injection vulnerability in the web interface in OpenVPN Access Server 2.1.4 allows remote attackers to inject arbitrary HTTP headers and consequently conduct session fixation attacks and possibly HTTP response splitting attacks via "%0A" characters in the PATH_INFO to __session_start__/.

Produtos afetados

n/a · n/a

Referências

https://sysdream.com/news/lab/2017-05-05-cve-2017-5868-openvpn-access-server-crlf-injection-with-session-fixation/http://www.openwall.com/lists/oss-security/2017/05/23/13 http://www.securitytracker.com/id/1038547