Vulnerability Details : CVE-2024-28882
OpenVPN from 2.6.0 through 2.6.10 in a server role accepts multiple exit notifications from authenticated clients which will extend the validity of a closing session
Products affected by CVE-2024-28882
- cpe:2.3:a:openvpn:openvpn:*:*:*:*:community:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2024-28882
0.53%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 66 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2024-28882
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
4.3
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L |
2.8
|
1.4
|
134c704f-9b21-4f2e-91b3-4a467353bcc0 | 2024-11-01 |
CWE ids for CVE-2024-28882
-
The product does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed.Assigned by: security@openvpn.net (Secondary)
References for CVE-2024-28882
-
https://community.openvpn.net/openvpn/wiki/CVE-2024-28882
CVE-2024-28882 – OpenVPN CommunityVendor Advisory
-
https://www.mail-archive.com/openvpn-users@lists.sourceforge.net/msg07634.html
[Openvpn-users] OpenVPN 2.6.11 releasedMailing List
Jump to