CVE-2020-15077 Auth bypass in OpenVPN Access Server

What is CVE-2020-15077?

CVE-2020-15077 is a medium-severity authentication bypass vulnerability in OpenVPN Access Server, published on 4 Jun 2021. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

OpenVPN Access Server 2.8.7 and earlier versions allows a remote attackers to bypass authentication and access control channel data on servers configured with deferred authentication, which can be used to potentially trigger further information leaks.

Weakness: CWE-287, CWE-305

Which versions are affected by CVE-2020-15077?

It affects 1 product.

Products include Openvpn Openvpn Access Server.

How do I fix CVE-2020-15077?

No fix has been published for CVE-2020-15077 yet. Limit exposure of the affected software until one is available.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2020-15077 being exploited?

There is no known exploitation of CVE-2020-15077 in the wild and no public exploit code.

Other vulnerabilities in OpenVPN Access Server

• CVE-2020-8953 Auth bypass in n/a Critical 9.8
• CVE-2021-4234 Denial of service in OpenVPN Access Server High 7.5
• CVE-2022-33737 Information disclosure in OpenVPN Access Server High 7.5
• CVE-2022-33738 Weak cryptography in OpenVPN Access Server High 7.5
• CVE-2020-36382 Denial of service in OpenVPN Access Server High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-2fc6-fh8m-r4wf.