CVE-2020-11462
Last modified
CVE-2020-11462 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. An issue was discovered in OpenVPN Access Server before 2.7.0 and 2.8.x before 2.8.3. With the full featured RPC2 interface enabled, it is possible to achieve a temporary DoS state of the management interface when sending an XML Entity Expansion (XEE) payload to the XMLRPC based RPC2 interface. EPSS estimates a 1.25% chance of exploitation in the next 30 days.
Description
An issue was discovered in OpenVPN Access Server before 2.7.0 and 2.8.x before 2.8.3. With the full featured RPC2 interface enabled, it is possible to achieve a temporary DoS state of the management interface when sending an XML Entity Expansion (XEE) payload to the XMLRPC based RPC2 interface. The duration of the DoS state depends on available memory and CPU speed. The default restricted mode of the RPC2 interface is NOT vulnerable.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Openvpn | Openvpn Access Server | < 2.7.0 |
| Openvpn | Openvpn Access Server | >= 2.8.0, <= 2.8.3 |
References
- https://openvpn.net/vpn-server-resources/release-notes/#Release_notes_for_OpenVPN_Access_Server_283Release Notes, Vendor Advisory
- https://openvpn.net/vpn-server-resources/release-notes/#Release_notes_for_OpenVPN_Access_Server_283Release Notes, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2020-11462?
How severe is CVE-2020-11462?
How do I fix CVE-2020-11462?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2020
- CVE-2020-11454Microstrategy Web 10.4 is vulnerable to Stored XSS in the HT…5.4
- CVE-2020-11455LimeSurvey before 4.1.12+200324 contains a path traversal vu…9.8
- CVE-2020-11456LimeSurvey before 4.1.12+200324 has stored XSS in applicatio…5.4
- CVE-2020-11457pfSense before 2.4.5 has stored XSS in system_usermanager_ad…5.4
- CVE-2020-11458app/Model/feed.php in MISP before 2.4.124 allows administrat…4.9
- CVE-2020-1146<p>An elevation of privilege vulnerability exists when the M…6.6
- CVE-2020-11463An issue was discovered in Deskpro before 2019.8.0. The /api…7.5
- CVE-2020-11464An issue was discovered in Deskpro before 2019.8.0. The /api…4.3
- CVE-2020-11465An issue was discovered in Deskpro before 2019.8.0. The /api…8.8
- CVE-2020-11466An issue was discovered in Deskpro before 2019.8.0. The /api…4.3
- CVE-2020-11467An issue was discovered in Deskpro before 2019.8.0. This pro…7.2
- CVE-2020-11469Zoom Client for Meetings through 4.6.8 on macOS copies runwi…7.8
Are you affected by CVE-2020-11462?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST