OpenVPN Access Server CVE-2013-2692 Cross Site Request Forgery Vulnerability

Bugtraq ID:	59736
Class:	Input Validation Error
CVE:	CVE-2013-2692
Remote:	Yes
Local:	No
Published:	May 08 2013 12:00AM
Updated:	May 08 2013 12:00AM
Credit:	Charlie Eriksen via Secunia
Vulnerable:
Not Vulnerable:

OpenVPN Access Server CVE-2013-2692 Cross Site Request Forgery Vulnerability

OpenVPN Access Server is prone to a cross-site request-forgery vulnerability.

Exploiting this issue may allow a remote attacker to perform certain unauthorized actions in the context of the affected application. Other attacks are also possible.

OpenVPN Access Server 1.8.4 is vulnerable; other versions may also be affected.

OpenVPN Access Server CVE-2013-2692 Cross Site Request Forgery Vulnerability

To exploit this issue an attacker must entice an unsuspecting victim to open a malicious URI.

OpenVPN Access Server CVE-2013-2692 Cross Site Request Forgery Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

OpenVPN Access Server CVE-2013-2692 Cross Site Request Forgery Vulnerability

References:

• Access Server release notes for 1.8.5 (changes made since 1.8.4) (OpenVPN)
  
• OpenVPN Access Server Homepage (OpenVPN)