CVE-2022-3761 Information disclosure in OpenVPN Connect

What is CVE-2022-3761?

CVE-2022-3761 is a medium-severity vulnerability in OpenVPN Connect, published on 17 Oct 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

OpenVPN Connect versions before 3.4.0.4506 (macOS) and OpenVPN Connect before 3.4.0.3100 (Windows) allows man-in-the-middle attackers to intercept configuration profile download requests which contains the users credentials

Weakness: CWE-295

Which versions are affected by CVE-2022-3761?

It affects 1 product.

Products include Openvpn Connect.

How do I fix CVE-2022-3761?

No fix has been published for CVE-2022-3761 yet. Limit exposure of the affected software until one is available.

Is CVE-2022-3761 being exploited?

There is no known exploitation of CVE-2022-3761 in the wild and no public exploit code.

Other vulnerabilities in OpenVPN Connect

• CVE-2026-9560 Privilege escalation in OpenVPN Connect Critical 9.4
• CVE-2023-7245 Code injection in OpenVPN Connect High 7.8
• CVE-2023-7224 Code injection in OpenVPN Connect High 7.8
• CVE-2021-3613 Code injection in OpenVPN Connect High 7.8
• CVE-2020-9442 Privilege escalation in n/a High 7.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-64ff-hjjg-hwr8.