Skip to main content

Openvpn Access Server CVE-2021-3824

MEDIUM
Improper Neutralization of Encoded URI Schemes in a Web Page (CWE-84)
2021-09-23 security@openvpn.net
Code Injection Openvpn Access Server
6.1
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
6.1 MEDIUM
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None

Lifecycle Timeline

1
CVE Published
Sep 23, 2021 - 15:15 nvd
MEDIUM 6.1

DescriptionNVD

OpenVPN Access Server 2.9.0 through 2.9.4 allow remote attackers to inject arbitrary web script or HTML via the web login page URL.

AnalysisAI

OpenVPN Access Server 2.9.0 through 2.9.4 allow remote attackers to inject arbitrary web script or HTML via the web login page URL. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-84. OpenVPN Access Server 2.9.0 through 2.9.4 allow remote attackers to inject arbitrary web script or HTML via the web login page URL. Affected products include: Openvpn Openvpn Access Server. Version information: through 2.9.4.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Openvpn Access Server

View all
CVE-2017-5868 MEDIUM POC
6.1 May 26

CRLF injection vulnerability in the web interface in OpenVPN Access Server 2.1.4 allows remote attackers to inject arbit
CVE-2014-9104 MEDIUM POC
6.8 Nov 26

Multiple cross-site request forgery (CSRF) vulnerabilities in the XML-RPC API in the Desktop Client in OpenVPN Access Se
CVE-2023-46850 CRITICAL
9.8 Nov 11

Use after free in OpenVPN version 2.6.0 to 2.6.6 may lead to undefined behavoir, leaking memory buffers or remote execut
CVE-2020-8953 CRITICAL
9.8 Feb 13

OpenVPN Access Server 2.8.x before 2.8.1 allows LDAP authentication bypass (except when a user is enrolled in two-factor
CVE-2023-46849 HIGH
7.5 Nov 11

Using the --fragment option in certain configuration setups OpenVPN version 2.6.0 to 2.6.6 allows an attacker to trigger
CVE-2022-33738 HIGH
7.5 Jul 06

OpenVPN Access Server before 2.11 uses a weak random generator used to create user session token for the web portal. Rat
CVE-2022-33737 HIGH
7.5 Jul 06

The OpenVPN Access Server installer creates a log file readable for everyone, which from version 2.10.0 and before 2.11.
CVE-2020-15074 HIGH
7.5 Jul 14

OpenVPN Access Server older than version 2.8.4 and version 2.9.5 generates new user authentication tokens instead of reu
CVE-2020-11462 HIGH
7.5 May 04

An issue was discovered in OpenVPN Access Server before 2.7.0 and 2.8.x before 2.8.3. Rated high severity (CVSS 7.5), th
CVE-2014-8104 MEDIUM
6.8 Dec 03

OpenVPN 2.x before 2.0.11, 2.1.x, 2.2.x before 2.2.3, and 2.3.x before 2.3.6 allows remote authenticated users to cause

CVE-2013-2061 LOW POC
2.6 Nov 18

The openvpn_decrypt function in crypto.c in OpenVPN 2.3.0 and earlier, when running in UDP mode, allows remote attackers
CVE-2013-2692 MEDIUM
6.8 May 13

Cross-site request forgery (CSRF) vulnerability in the Admin web interface in OpenVPN Access Server before 1.8.5 allows

Same weakness CWE-84 – Improper Neutralization of Encoded URI Schemes in a Web Page

View all
CVE-2022-40181 HIGH
8.3
CVE-2024-45045 MEDIUM
6.1
CVE-2020-7011 MEDIUM
6.1
CVE-2025-25329 MEDIUM
5.5
CVE-2025-25334 MEDIUM
5.5
CVE-2025-25331 MEDIUM
5.5
CVE-2025-25330 MEDIUM
5.5
CVE-2025-25326 MEDIUM
5.5

Same technique Code Injection

View all
CVE-2012-0158 HIGH POC
8.8
CVE-2014-6287 CRITICAL POC
9.8
CVE-2017-7494 CRITICAL POC
9.8
CVE-2025-24893 CRITICAL POC
9.8
CVE-2025-47812 CRITICAL POC
10.0
CVE-2013-3906 HIGH POC
7.8
CVE-2017-9822 HIGH POC
8.8
CVE-2018-1273 CRITICAL POC
9.8

Share

CVE-2021-3824 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy