CVE-2010-3902
published 2010-10-14CVE-2010-3902: OpenConnect before 2.26 places the webvpn cookie value in the debugging output, which might allow remote attackers to obtain sensitive information by reading…
PriorityP419medium5CVSS 2.0
AVNACLAuNCPINAN
EPSS
2.25%
81.0th percentile
OpenConnect before 2.26 places the webvpn cookie value in the debugging output, which might allow remote attackers to obtain sensitive information by reading this output, as demonstrated by output posted to the public openconnect-devel mailing list.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | openconnect | < openconnect 3.02-1 (bookworm) | openconnect 3.02-1 (bookworm) |
| infradead | openconnect | <= 2.25 | — |
| infradead | openconnect | — | — |
| infradead | openconnect | — | — |
| infradead | openconnect | — | — |
| infradead | openconnect | — | — |
| infradead | openconnect | — | — |
| infradead | openconnect | >= 0 < 3.02-1 | 3.02-1 |
| infradead | openconnect | >= 0 < 3.02-1 | 3.02-1 |
| infradead | openconnect | >= 0 < 3.02-1 | 3.02-1 |
| infradead | openconnect | >= 0 < 3.02-1 | 3.02-1 |
CVSS provenance
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
osv5.0MEDIUM
vendor_debian5.0LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Debian
CVE-2010-3902: openconnect - OpenConnect before 2.26 places the webvpn cookie value in the debugging output, ...
vendor_debian·2010·CVSS 5.0
CVE-2010-3902 [MEDIUM] CVE-2010-3902: openconnect - OpenConnect before 2.26 places the webvpn cookie value in the debugging output, ...
OpenConnect before 2.26 places the webvpn cookie value in the debugging output, which might allow remote attackers to obtain sensitive information by reading this output, as demonstrated by output posted to the public openconnect-devel mailing list.
Scope: local
bookworm: resolved (fixed in 3.02-1)
bullseye: resolved (fixed in 3.02-1)
forky: resolved (fixed in 3.02-1)
sid: resolved (fixed in 3.02-1)
trixie: resolved (fixed in 3.02-1)
GHSA
GHSA-mvq9-gwc4-9r68: OpenConnect before 2
ghsa_unreviewed·2022-05-17
CVE-2010-3902 [MEDIUM] CWE-200 GHSA-mvq9-gwc4-9r68: OpenConnect before 2
OpenConnect before 2.26 places the webvpn cookie value in the debugging output, which might allow remote attackers to obtain sensitive information by reading this output, as demonstrated by output posted to the public openconnect-devel mailing list.
OSV
CVE-2010-3902: OpenConnect before 2
osv·2010-10-14·CVSS 5.0
CVE-2010-3902 [MEDIUM] CVE-2010-3902: OpenConnect before 2
OpenConnect before 2.26 places the webvpn cookie value in the debugging output, which might allow remote attackers to obtain sensitive information by reading this output, as demonstrated by output posted to the public openconnect-devel mailing list.
No detection rules found.
No public exploits indexed.
http://lists.fedoraproject.org/pipermail/package-announce/2010-November/051620.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2010-November/051637.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2010-November/051640.htmlhttp://secunia.com/advisories/42381http://www.infradead.org/openconnect.htmlhttp://www.securityfocus.com/bid/44111http://www.vupen.com/english/advisories/2010/3078http://lists.fedoraproject.org/pipermail/package-announce/2010-November/051620.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2010-November/051637.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2010-November/051640.htmlhttp://secunia.com/advisories/42381http://www.infradead.org/openconnect.htmlhttp://www.securityfocus.com/bid/44111http://www.vupen.com/english/advisories/2010/3078
2010-10-14
Published