CVE-2023-7245

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-7245
The nodejs framework in OpenVPN Connect 3.0 through 3.4.3 (Windows)/3.4.7 (macOS) was not properly configured, which allows a local user to execute arbitrary code within the nodejs process context via the ELECTRON_RUN_AS_NODE environment variable
CVSS

No CVSS.

References
Link Resource
https://openvpn.net/vpn-server-resources/openvpn-connect-for-macos-change-log/
https://openvpn.net/vpn-server-resources/openvpn-connect-for-windows-change-log/
Configurations

No configuration.

History

20 Feb 2024, 19:50

Type Values Removed Values Added
Summary
  • (es) El framework nodejs en OpenVPN Connect 3.0 a 3.4.3 (Windows)/3.4.7 (macOS) no se configuró correctamente, lo que permite a un usuario local ejecutar código arbitrario dentro del contexto del proceso nodejs a través de la variable de entorno ELECTRON_RUN_AS_NODE

20 Feb 2024, 11:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-02-20 11:15

Updated : 2024-02-20 19:50

NVD link : CVE-2023-7245

Mitre link : CVE-2023-7245

CVE.ORG link : CVE-2023-7245

JSON object : View

Products Affected

No product.

CWE
CWE-95

Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')