CVE-2020-25200
Last modified
CVE-2020-25200 is a medium-severity vulnerability rated 5.3/10 on the CVSS scale. Pritunl 1.29.2145.25 allows attackers to enumerate valid VPN usernames via a series of /auth/session login attempts. Initially, the server will return error 401. EPSS estimates a 7.47% chance of exploitation in the next 30 days.
Description
Pritunl 1.29.2145.25 allows attackers to enumerate valid VPN usernames via a series of /auth/session login attempts. Initially, the server will return error 401. However, if the username is valid, then after 20 login attempts, the server will start responding with error 400. Invalid usernames will receive error 401 indefinitely. Note: This has been disputed by the vendor as not a vulnerability. They argue that this is an intended design
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Pritunl | Pritunl | 1.29.2145.25 |
References
- https://github.com/lukaszstu/pritunl/blob/master/CVE-2020-25200Exploit, Third Party Advisory
- https://pritunl.comVendor Advisory
- https://pritunl.com/securityVendor Advisory
- https://github.com/lukaszstu/pritunl/blob/master/CVE-2020-25200Exploit, Third Party Advisory
- https://pritunl.comVendor Advisory
- https://pritunl.com/securityVendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2020-25200?
How severe is CVE-2020-25200?
How do I fix CVE-2020-25200?
Are you affected by CVE-2020-25200?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST