CVE-2014-9104

Description

Multiple cross-site request forgery (CSRF) vulnerabilities in the XML-RPC API in the Desktop Client in OpenVPN Access Server 1.5.6 and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) disconnecting established VPN sessions, (2) connect to arbitrary VPN servers, or (3) create VPN profiles and execute arbitrary commands via crafted API requests.

References

https://www.youtube.com/watch?v=qhgysgfvQh8

https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20140716-1_OpenVPN_Access_Server_Desktop_Client_Remote_Code_Execution_via_CSRF_v10.txt

https://euvd.enisa.europa.eu/vulnerability/EUVD-2014-8930

http://www.securityfocus.com/archive/1/532795/100/0/threaded

http://seclists.org/fulldisclosure/2014/Jul/76

http://openvpn.net/index.php/access-server/security-advisories.html

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3

EPSS