CVE-2017-5868

Severity: medium (CVSS 6.1 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2017-05-26 · updated 2026-06-17
Weakness: CWE-93

Description

CRLF injection vulnerability in the web interface in OpenVPN Access Server 2.1.4 allows remote attackers to inject arbitrary HTTP headers and consequently conduct session fixation attacks and possibly HTTP response splitting attacks via "%0A" characters in the PATH_INFO to __session_start__/.

Affected products

OpenVPN Access Server: 2.1.4

References

http://www.openwall.com/lists/oss-security/2017/05/23/13
http://www.securitytracker.com/id/1038547
https://sysdream.com/news/lab/2017-05-05-cve-2017-5868-openvpn-access-server-crlf-injection-with-session-fixation/
http://www.openwall.com/lists/oss-security/2017/05/23/13
http://www.securitytracker.com/id/1038547
https://sysdream.com/news/lab/2017-05-05-cve-2017-5868-openvpn-access-server-crlf-injection-with-session-fixation/

Get alerted when CVE-2017-5868 or the next vulnerability affects your stack