Vulnerability · Published Apr 21, 2021 · Assigned by mitre

CVE-2020-27569

High 7.5

In plain English

A high-severity security flaw in the openvpn package (Alpine). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 60% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)7.5High

Exploit odds (30 days)0.9%top 40.2% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Arbitrary File Write exists in Aviatrix VPN Client 2.8.2 and earlier. The VPN service writes logs to a location that is world writable and can be leveraged to gain write access to any file on the system.

Affected packages & fixed versions

Ecosystem	Package	Advisory
Alpine:v3.20	openvpn	ALPINE-CVE-2020-27569
Alpine:v3.21	openvpn	ALPINE-CVE-2020-27569
Alpine:v3.22	openvpn	ALPINE-CVE-2020-27569
Alpine:v3.23	openvpn	ALPINE-CVE-2020-27569
Alpine:v3.24	openvpn	ALPINE-CVE-2020-27569

Affected products (as reported)

Vendor	Product	Versions
n/a	n/a	n/a

References

https://docs.aviatrix.com/HowTos/security_bulletin_article.html#openvpn-abitrary-file-write x_refsource_CONFIRM