Description (CNA)
The nodejs framework in OpenVPN Connect 3.0 through 3.4.3 (Windows)/3.4.7 (macOS) was not properly configured, which allows a local user to execute arbitrary code within the nodejs process context via the ELECTRON_RUN_AS_NODE environment variable
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| OpenVPN / OpenVPN Connect | affected 3.0 (Windows) through 3.4.3; affected 3.0 (macOS) through 3.4.7 |
CWE
CWE-95
References
- https://openvpn.net/vpn-server-resources/openvpn-connect-for-macos-change-log/
- https://openvpn.net/vpn-server-resources/openvpn-connect-for-windows-change-log/
ADP enrichment
No English description supplied.
No English description supplied.
No references supplied.