CVE-2010-3902

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2010-10-14 · updated 2026-06-16
Weakness: CWE-200

Description

OpenConnect before 2.26 places the webvpn cookie value in the debugging output, which might allow remote attackers to obtain sensitive information by reading this output, as demonstrated by output posted to the public openconnect-devel mailing list.

Affected products

Infradead Openconnect: through 2.25; 1.00, 1.10, 1.20, 1.30, 2.22

References

http://lists.fedoraproject.org/pipermail/package-announce/2010-November/051620.html
http://lists.fedoraproject.org/pipermail/package-announce/2010-November/051637.html
http://lists.fedoraproject.org/pipermail/package-announce/2010-November/051640.html
http://secunia.com/advisories/42381
http://www.infradead.org/openconnect.html
http://www.securityfocus.com/bid/44111
http://www.vupen.com/english/advisories/2010/3078
http://lists.fedoraproject.org/pipermail/package-announce/2010-November/051620.html
http://lists.fedoraproject.org/pipermail/package-announce/2010-November/051637.html
http://lists.fedoraproject.org/pipermail/package-announce/2010-November/051640.html
http://secunia.com/advisories/42381
http://www.infradead.org/openconnect.html

Get alerted when CVE-2010-3902 or the next vulnerability affects your stack