« Volver al listado

CVE-2022-3761

Estado: ModificadaMedia (5.9)—

OpenVPN Connect versions before 3.4.0.4506 (macOS) and OpenVPN Connect before 3.4.0.3100 (Windows) allows man-in-the-middle attackers to intercept configuration profile download requests which contains the users credentials

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Openvpn — Connect

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-3761",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.9,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.2
      }
    ]
  },
  "affected": [
    {
      "source": "security@openvpn.net",
      "affectedData": [
        {
          "vendor": "OpenVPN Inc",
          "product": "OpenVPN Connect",
          "versions": [
            {
              "status": "affected",
              "version": "until 3.4.0.4506",
              "lessThan": "3.4.0.4506",
              "versionType": "macOS"
            },
            {
              "status": "affected",
              "version": "until 3.4.0.3100",
              "lessThan": "3.4.0.3100",
              "versionType": "Windows"
            }
          ],
          "platforms": [
            "Windows",
            "MacOS"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2023-10-17T13:15:11.573",
  "references": [
    {
      "url": "https://openvpn.net/vpn-server-resources/openvpn-connect-for-macos-change-log/",
      "tags": [
        "Release Notes"
      ],
      "source": "security@openvpn.net"
    },
    {
      "url": "https://openvpn.net/vpn-server-resources/openvpn-connect-for-windows-change-log/",
      "tags": [
        "Release Notes"
      ],
      "source": "security@openvpn.net"
    },
    {
      "url": "https://openvpn.net/vpn-server-resources/openvpn-connect-for-macos-change-log/",
      "tags": [
        "Release Notes"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://openvpn.net/vpn-server-resources/openvpn-connect-for-windows-change-log/",
      "tags": [
        "Release Notes"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@openvpn.net",
      "description": [
        {
          "lang": "en",
          "value": "CWE-295"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-295"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "OpenVPN Connect versions before 3.4.0.4506 (macOS) and OpenVPN Connect before 3.4.0.3100 (Windows) allows man-in-the-middle attackers to intercept configuration profile download requests which contains the users credentials"
    },
    {
      "lang": "es",
      "value": "Las versiones de OpenVPN Connect anteriores a 3.4.0.4506 (macOS) y OpenVPN Connect anteriores a 3.4.0.3100 (Windows) permiten a atacantes intermediarios interceptar solicitudes de descarga de perfiles de configuración que contienen las credenciales de los usuarios."
    }
  ],
  "lastModified": "2026-06-17T05:00:15.470",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:openvpn:connect:*:*:*:*:*:windows:*:*",
              "vulnerable": true,
              "matchCriteriaId": "54A4FF64-4693-4196-87F8-F25728A1D9E4",
              "versionEndExcluding": "3.4.0.3121"
            },
            {
              "criteria": "cpe:2.3:a:openvpn:connect:*:*:*:*:*:macos:*:*",
              "vulnerable": true,
              "matchCriteriaId": "70DC57A0-4862-443C-AC95-5EEED057B719",
              "versionEndExcluding": "3.4.0.4506"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@openvpn.net"
}