Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2010-3902

OpenConnect before 2.26 places the webvpn cookie value in the debugging output, which might allow remote attackers to obtain sensitive information by reading this output, as demonstrated by output posted to the public openconnect-devel mailing list.

Published

2010-10-14T05:58:42.927

Last Modified

2025-04-11T00:51:21.963

Status

Deferred

Source

[email protected]

Severity

CVSSv2: 5.0 (MEDIUM)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: NONE
  • Availability Impact: NONE
Exploitability Score

10.0

Impact Score

2.9

Weaknesses
  • Type: Primary
    CWE-200
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application infradead openconnect ≤ 2.25 Yes
Application infradead openconnect 1.00 Yes
Application infradead openconnect 1.10 Yes
Application infradead openconnect 1.20 Yes
Application infradead openconnect 1.30 Yes
Application infradead openconnect 2.22 Yes
References