CVE-2021-41583
Medium
Description
vpn-user-portal (aka eduVPN or Let's Connect!) before 2.3.14, as packaged for Debian 10, Debian 11, and Fedora, allows remote authenticated users to obtain OS filesystem access, because of the interaction of QR codes with an exec that uses the -r option. This can be leveraged to obtain additional VPN access.
SeverityMedium
CVSS6.5
Exploit probability—
ProductEduvpn Vpn-user-portal
PublishedSep 24, 2021
First seenSep 24, 2021
How to fix
Update
- eduvpn vpn-user-portal2.3.14 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| eduvpn vpn-user-portal | 2.3.2 ≤ v < 2.3.14 | 2.3.14 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.