CVE-2022-0547

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

OpenVPN 2.1 until v2.4.12 and v2.5.6 may enable authentication bypass in external authentication plug-ins when more than one of them makes use of deferred authentication replies, which allows an external user to be granted access with only partially correct credentials.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-305 CWE-287

Affected software

Vendor	Product	Versions
n/a	OpenVPN	version 2.1 until version 2.4.12 and 2.5.6.

References

https://community.openvpn.net/openvpn/wiki/CVE-2022-0547Vendor Advisory
https://community.openvpn.net/openvpn/wiki/SecurityAnnouncementsVendor Advisory
https://lists.debian.org/debian-lts-announce/2022/05/msg00002.htmlMailing List, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GFXJ35WKPME4HYNQCQNAJHLCZOJL2SAE/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R36OYC5SJ6FLPVAYJYYT4MOJ2I7MGYFF/
https://openvpn.net/community-downloads/Patch, Vendor Advisory
https://community.openvpn.net/openvpn/wiki/CVE-2022-0547Vendor Advisory
https://community.openvpn.net/openvpn/wiki/SecurityAnnouncementsVendor Advisory
https://lists.debian.org/debian-lts-announce/2022/05/msg00002.htmlMailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2025/03/msg00005.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GFXJ35WKPME4HYNQCQNAJHLCZOJL2SAE/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R36OYC5SJ6FLPVAYJYYT4MOJ2I7MGYFF/
https://openvpn.net/community-downloads/Patch, Vendor Advisory

Timeline

Published: Mar 18, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-05496.5An issue has been discovered in GitLab CE/EE affecting all versions before 14.3.6, all versions starting from 14.4 before 14.4.4, all versio CVE-2022-05507.2Improper Input Validation vulnerability in custom report logo upload in Nozomi Networks Guardian, and CMC allows an authenticated attacker w CVE-2022-05517.2Improper Input Validation vulnerability in project file upload in Nozomi Networks Guardian and CMC allows an authenticated attacker with adm CVE-2022-05525.9A flaw was found in the original fix for the netty-codec-http CVE-2021-21409, where the OpenShift Logging openshift-logging/elasticsearch6-r CVE-2022-05534.6There is no check to see if slot 0 is being uploaded from the device to the host. When using encrypted images this means the unencrypted fir CVE-2022-05547.8Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.CVE-2022-05558.4Subiquity Shows Guided Storage Passphrase in Plaintext with Read-all Permissions CVE-2022-05567.8A local privilege escalation vulnerability caused by incorrect permission assignment in some directories of the Zyxel AP Configurator (ZAC) CVE-2022-05577.2OS Command Injection in Packagist microweber/microweber prior to 1.2.11.CVE-2022-05585.4Cross-site Scripting (XSS) - Stored in Packagist microweber/microweber prior to 1.2.11.CVE-2022-05599.8Use After Free in GitHub repository radareorg/radare2 prior to 5.6.2.CVE-2022-05606.1Open Redirect in Packagist microweber/microweber prior to 1.2.11.