CVE-2024-8474 - AskarLabs CVE Database

CVE-2024-8474

Vendor Openvpn

Product OpenVPN Connect

Weakness CWE-212

Published January 6, 2025

Last update January 6, 2025

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

OpenVPN Connect before version 3.5.0 can contain the configuration profile's clear-text private key which is logged in the application log, which an unauthorized actor can use to decrypt the VPN traffic

Key dates

02Disclosure timeline

January 6, 2025 CVE published

January 6, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2024-8474 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/212.html

Related vulnerabilities

04Related CVE

CVE-2025-58049 XWiki PDF export jobs store sensitive cookies unencrypted in job statuses CVE-2024-41156 CVE-2022-23605 Expired Ephemeral Messages not reliably removed in wire-webapp CVE-2025-62483 Zoom Clients - Improper Removal of Sensitive Information CVE-2022-1650 Improper Removal of Sensitive Information Before Storage or Transfer in eventsource/eventsource