CVE-2020-11462: XEE
An issue was discovered in OpenVPN Access Server before 2.7.0 and 2.8.x before 2.8.3. With the full featured RPC2 interface enabled, it is possible to achieve a temporary DoS state of the management interface when sending an XML Entity Expansion (XEE) payload to the XMLRPC based RPC2 interface. The duration of the DoS state depends on available memory and CPU speed. The default restricted mode of the RPC2 interface is NOT vulnerable.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2020-11462?
CVE-2020-11462 is a vulnerability in OpenVPN Access Server that allows for a temporary denial-of-service (DoS) state of the management interface.
How does CVE-2020-11462 impact OpenVPN Access Server?
CVE-2020-11462 can be exploited to achieve a temporary DoS state of the management interface when sending a specific XML Entity Expansion (XEE) payload.
What versions of OpenVPN Access Server are affected by CVE-2020-11462?
OpenVPN Access Server versions before 2.7.0 and 2.8.x before 2.8.3 are affected by CVE-2020-11462.
What is the severity of CVE-2020-11462?
CVE-2020-11462 has a severity score of 7.5 (High).
How can I fix CVE-2020-11462 in OpenVPN Access Server?
To fix CVE-2020-11462, it is recommended to update OpenVPN Access Server to version 2.7.0 or 2.8.3 or later.