CVE-2020-15590

{
  "id": "CVE-2020-15590",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2020-09-14T22:15:11.503",
  "references": [
    {
      "url": "https://github.com/sickcodes",
      "tags": [
        "Not Applicable"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/sickcodes/security/blob/master/advisories/SICK-2020-001.md",
      "tags": [
        "Exploit",
        "Mitigation",
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://sick.codes/cve-2020-15590/",
      "tags": [
        "Exploit",
        "Mitigation",
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/sickcodes",
      "tags": [
        "Not Applicable"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/sickcodes/security/blob/master/advisories/SICK-2020-001.md",
      "tags": [
        "Exploit",
        "Mitigation",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://sick.codes/cve-2020-15590/",
      "tags": [
        "Exploit",
        "Mitigation",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability in the Private Internet Access (PIA) VPN Client for Linux 1.5 through 2.3+ allows remote attackers to bypass an intended VPN kill switch mechanism and read sensitive information via intercepting network traffic. Since 1.5, PIA has supported a “split tunnel” OpenVPN bypass option. The PIA killswitch & associated iptables firewall is designed to protect you while using the Internet. When the kill switch is configured to block all inbound and outbound network traffic, privileged applications can continue sending & receiving network traffic if net.ipv4.ip_forward has been enabled in the system kernel parameters. For example, a Docker container running on a host with the VPN turned off, and the kill switch turned on, can continue using the internet, leaking the host IP (CWE 200). In PIA 2.4.0+, policy-based routing is enabled by default and is used to direct all forwarded packets to the VPN interface automatically."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad en el Private Internet Access (PIA) VPN Client  para Linux versiones 1.5 hasta 2.3+, permite a atacantes remotos omitir un mecanismo de desconexión automática de VPN previsto y leer información confidencial por medio de la interceptación del tráfico de red. A partir de la versión 1.5, PIA ha admitido una opción de omisión de OpenVPN “split tunnel”. El firewall PIA killswitch & associated iptables asociado está diseñado para protegerle mientras utiliza Internet. Cuando el switch de interrupción está configurado para bloquear todo el tráfico de red entrante y saliente, las aplicaciones privilegiadas pueden continuar enviando y recibiendo tráfico de red si net.ipv4.ip_forward ha sido habilitado en los parámetros del kernel del sistema. Por ejemplo, un contenedor Docker que se ejecuta en un host con la VPN apagada y el switch de interrupción encendido puede continuar usando Internet, filtrando la IP del host (CWE 200). En PIA versiones 2.4.0+, El enrutamiento basado en políticas está habilitado por defecto y es usado para dirigir todos los paquetes reenviados hacia la interfaz VPN automáticamente"
    }
  ],
  "lastModified": "2026-06-17T02:56:52.307",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:privateinternetaccess:private_internet_access_vpn_client:*:*:*:*:*:linux:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EF164CA0-C1B5-4D63-808C-F8840290ED6E",
              "versionEndExcluding": "2.4.0",
              "versionStartIncluding": "1.5.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}