CyberSec.Space Logo
Back to CVE Browser

CVE-2021-45810

HIGH
7.5
CVSS Severity Score
EPSS Score0.1780%
EPSS Percentile44.24th
PublishedMar 22, 2022
Last ModifiedNov 21, 2024

Vulnerability Description

GlobalProtect-openconnect versions prior to 2.0.0 (exclusive) are affected by incorrect access control in GPService through DBUS, GUI. The way GlobalProtect-Openconnect is set up enables arbitrary users to start a VPN connection to arbitrary servers. By hosting an openconnect compatible server, the attack can redirect the entire host's traffic via their own server.

Affected Platforms (CPE)

📦
Globalprotect Openconnect Project

Globalprotect Openconnect

All versions

References & Advisories

🔗 https://github.com/yuezk/GlobalProtect-openconnect/issues/114
🔗 https://github.com/yuezk/GlobalProtect-openconnect/issues/114#issuecomment-1914008203
🔗 https://github.com/yuezk/GlobalProtect-openconnect/issues/114
🔗 https://github.com/yuezk/GlobalProtect-openconnect/issues/114#issuecomment-1914008203

Related Vulnerabilities

CVE-2021-458099.8

GlobalProtect-openconnect versions prior to 1.4.3 are affected by incorrect access control in GPService through DBUS, GUI Applicat...

CVE-2026-53430

Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in elixir-grpc grpc (GRPC.Compressor.Gzip, GRPC.Mes...

CVE-2026-48854

Allocation of Resources Without Limits or Throttling vulnerability in elixir-grpc grpc allows unauthenticated attackers to exhaust...

CVE-2026-48853

Deserialization of Untrusted Data and Allocation of Resources Without Limits or Throttling vulnerabilities in elixir-grpc grpc all...