CVE-2020-15074

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

OpenVPN Access Server older than version 2.8.4 and version 2.9.5 generates new user authentication tokens instead of reusing exiting tokens on reconnect making it possible to circumvent the initial token expiry timestamp.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-302CWE-613

Affected software

VendorProductVersions
n/aOpenVPN Access Server2.8.3 and prior versions in addition to 2.9.5

References

Timeline

Published
Jul 14, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-150757.1OpenVPN Connect installer for macOS version 3.2.6 and older may corrupt system critical files it should not have access via symlinks in /tmpCVE-2020-150767.8Private Tunnel installer for macOS version 3.0.1 and older versions may corrupt system critical files it should not have access via symlinksCVE-2020-150775.3OpenVPN Access Server 2.8.7 and earlier versions allows a remote attackers to bypass authentication and access control channel data on serveCVE-2020-150787.5OpenVPN 2.5.1 and earlier versions allows a remote attackers to bypass authentication and access control channel data on servers configured CVE-2020-150795.4In PrestaShop from version 1.5.0.0 and before version 1.7.6.6, there is improper access control in Carrier page, Module Manager and Module PCVE-2020-15087.6<p>A remote code execution vulnerability exists when Windows Media Audio Decoder improperly handles objects. An attacker who successfully exCVE-2020-150805.3In PrestaShop from version 1.7.4.0 and before version 1.7.6.6, some files should not be in the release archive, and others should not be accCVE-2020-150815.3In PrestaShop from version 1.5.0.0 and before 1.7.6.6, there is information exposure in the upload directory. The problem is fixed in versioCVE-2020-150828.8In PrestaShop from version 1.6.0.1 and before version 1.7.6.6, the dashboard allows rewriting all configuration variables. The problem is fiCVE-2020-150836.1In PrestaShop from version 1.7.0.0 and before version 1.7.6.6, if a target sends a corrupted file, it leads to a reflected XSS. The problem CVE-2020-150849.1In express-jwt (NPM package) up and including version 5.3.3, the algorithms entry to be specified in the configuration is not being enforcedCVE-2020-150856.1In Saleor Storefront before version 2.10.3, request data used to authenticate customers was inadvertently cached in the browser's local stor
CVE-2020-15074: High severity, CVSS 7.5 | Vulnix