Skip to main content

Improper Neutralization of Encoded URI Schemes in a Web Page

CVE-2021-3824

Medium
6.1/10

Summary

OpenVPN Access Server 2.9.0 through 2.9.4 allow remote attackers to inject arbitrary web script or HTML via the web login page URL.

  • LOW
  • NETWORK
  • LOW
  • CHANGED
  • REQUIRED
  • NONE
  • LOW
  • NONE

CWE-84 - Improper Neutralization of Encoded URI Schemes in a Web Page

The web application improperly neutralizes user-controlled input for executable script disguised with URI encodings.

References

Advisory Timeline

  • Published