CVE-2020-25200

nvd nist nuclei

Published: Oct 1, 2020Modified: Nov 21, 2024

5.3

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Exploitability: 3.9 / Impact: 1.4

Source: NVD

Description

Pritunl 1.29.2145.25 allows attackers to enumerate valid VPN usernames via a series of /auth/session login attempts. Initially, the server will return error 401. However, if the username is valid, then after 20 login attempts, the server will start responding with error 400. Invalid usernames will receive error 401 indefinitely. Note: This has been disputed by the vendor as not a vulnerability. They argue that this is an intended design

Affected (1)

Products: Pritunl: Pritunl

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Pritunl Pritunl	Version 1.29.2145.25

Related CWEs

Observable Discrepancy

The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.

References (6)

https://github.com/lukaszstu/pritunl/blob/master/CVE-2020-25200

Source: cve@mitre.org

ExploitThird Party Advisory

https://pritunl.com

Source: cve@mitre.org

Vendor Advisory

https://pritunl.com/security

Source: cve@mitre.org

Vendor Advisory

https://github.com/lukaszstu/pritunl/blob/master/CVE-2020-25200

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

https://pritunl.com

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://pritunl.com/security

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.