6.4
CVE-2010-3901
- EPSS 0.6%
- Veröffentlicht 14.10.2010 05:58:42
- Zuletzt bearbeitet 16.06.2026 23:23:47
- Erkennungen
LoginOpenConnect before 2.25 does not properly validate X.509 certificates, which allows man-in-the-middle attackers to spoof arbitrary AnyConnect SSL VPN servers via a crafted server certificate that (1) does not correspond to the server hostname or (2) is presented in circumstances involving a missing --cafile configuration option.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Infradead ≫ Openconnect Version <= 2.22
Infradead ≫ Openconnect Version 1.00
Infradead ≫ Openconnect Version 1.10
Infradead ≫ Openconnect Version 1.20
Infradead ≫ Openconnect Version 1.30
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.6% | 0.454 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| NIST | 6.4 | 10 | 4.9 |
AV:N/AC:L/Au:N/C:P/I:P/A:N
|
CWE-20 Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
http://www.infradead.org/openconnect.html
http://www.openwall.com/lists/oss-security/2010/08/01/1
http://www.openwall.com/lists/oss-security/2010/08/02/7