Skip to main content

Openvpn Access Server CVE-2022-33738

HIGH
Insufficient Entropy (CWE-331)
2022-07-06 security@openvpn.net
Information Disclosure Openvpn Access Server
7.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

1
CVE Published
Jul 06, 2022 - 16:15 nvd
HIGH 7.5

DescriptionNVD

OpenVPN Access Server before 2.11 uses a weak random generator used to create user session token for the web portal

AnalysisAI

OpenVPN Access Server before 2.11 uses a weak random generator used to create user session token for the web portal. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-331. OpenVPN Access Server before 2.11 uses a weak random generator used to create user session token for the web portal Affected products include: Openvpn Openvpn Access Server. Version information: before 2.11.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Openvpn Access Server

View all
CVE-2017-5868 MEDIUM POC
6.1 May 26

CRLF injection vulnerability in the web interface in OpenVPN Access Server 2.1.4 allows remote attackers to inject arbit
CVE-2014-9104 MEDIUM POC
6.8 Nov 26

Multiple cross-site request forgery (CSRF) vulnerabilities in the XML-RPC API in the Desktop Client in OpenVPN Access Se
CVE-2023-46850 CRITICAL
9.8 Nov 11

Use after free in OpenVPN version 2.6.0 to 2.6.6 may lead to undefined behavoir, leaking memory buffers or remote execut
CVE-2020-8953 CRITICAL
9.8 Feb 13

OpenVPN Access Server 2.8.x before 2.8.1 allows LDAP authentication bypass (except when a user is enrolled in two-factor
CVE-2023-46849 HIGH
7.5 Nov 11

Using the --fragment option in certain configuration setups OpenVPN version 2.6.0 to 2.6.6 allows an attacker to trigger
CVE-2022-33737 HIGH
7.5 Jul 06

The OpenVPN Access Server installer creates a log file readable for everyone, which from version 2.10.0 and before 2.11.
CVE-2020-15074 HIGH
7.5 Jul 14

OpenVPN Access Server older than version 2.8.4 and version 2.9.5 generates new user authentication tokens instead of reu
CVE-2020-11462 HIGH
7.5 May 04

An issue was discovered in OpenVPN Access Server before 2.7.0 and 2.8.x before 2.8.3. Rated high severity (CVSS 7.5), th
CVE-2014-8104 MEDIUM
6.8 Dec 03

OpenVPN 2.x before 2.0.11, 2.1.x, 2.2.x before 2.2.3, and 2.3.x before 2.3.6 allows remote authenticated users to cause

CVE-2013-2061 LOW POC
2.6 Nov 18

The openvpn_decrypt function in crypto.c in OpenVPN 2.3.0 and earlier, when running in UDP mode, allows remote attackers
CVE-2013-2692 MEDIUM
6.8 May 13

Cross-site request forgery (CSRF) vulnerability in the Admin web interface in OpenVPN Access Server before 1.8.5 allows

CVE-2021-3824 MEDIUM
6.1 Sep 23

OpenVPN Access Server 2.9.0 through 2.9.4 allow remote attackers to inject arbitrary web script or HTML via the web logi

Same weakness CWE-331 – Insufficient Entropy

View all
CVE-2025-47781 CRITICAL POC
9.8
CVE-2020-36925 CRITICAL POC
9.8
CVE-2023-49599 CRITICAL POC
9.8
CVE-2024-36400 CRITICAL POC
9.8
CVE-2022-34294 CRITICAL POC
9.8
CVE-2020-12735 CRITICAL POC
9.8
CVE-2026-22698 HIGH POC
7.5
CVE-2020-28924 HIGH POC
7.5

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Share

CVE-2022-33738 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy