CVE-2017-5868

6.1 mediumEPSS 4.6%

Medium (6.1) in openvpn openvpn access server. EPSS 4.6% chance of exploitation in the next 30 days.

CRLF injection vulnerability in the web interface in OpenVPN Access Server 2.1.4 allows remote attackers to inject arbitrary HTTP headers and consequently conduct session fixation attacks and possibly HTTP response splitting attacks via "%0A" characters in the PATH_INFO to __session_start__/.

Severity

CVSS 3.0

6.1 medium

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS: 4.6% chance of exploitation in the next 30 days; higher than 91% of CVEs (scores of 2026-10-31)
CWE: CWE-93
Published: 2017-05-26
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

openvpn:openvpn_access_server

References

http://www.openwall.com/lists/oss-security/2017/05/23/13
http://www.securitytracker.com/id/1038547
https://sysdream.com/news/lab/2017-05-05-cve-2017-5868-openvpn-access-server-crlf-injection-with-session-fixation/
http://www.openwall.com/lists/oss-security/2017/05/23/13
http://www.securitytracker.com/id/1038547

Check your stack JSON