CVE-2017-5868

PoC ×2—

CVSS 3.0

6.1 medium

EPSS

5%p91

Published

May 26, 2017 (May 26, 2017)

Modified

Jun 17, 2026

Description

CRLF injection vulnerability in the web interface in OpenVPN Access Server 2.1.4 allows remote attackers to inject arbitrary HTTP headers and consequently conduct session fixation attacks and possibly HTTP response splitting attacks via "%0A" characters in the PATH_INFO to __session_start__/.

Vendors: openvpn
Products: openvpn access server
Weakness: CWE-93
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

NVD CVE.org GitHub PoCs EPSS (4.6%)

In the news0 stories

No ingested article mentions this CVE yet.