{"timestamp":"2024-04-24T16:14:46.904203Z","id":"CVE-2020-25200","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}

[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]

https://github.com/lukaszstu/pritunl/blob/master/CVE-2020-25200

https://pritunl.com

https://pritunl.com/security

MITRE disputed

** DISPUTED ** Pritunl 1.29.2145.25 allows attackers to enumerate valid VPN usernames via a series of /auth/session login attempts. Initially, the server will return error 401. However, if the username is valid, then after 20 login attempts, the server will start responding with error 400. Invalid usernames will receive error 401 indefinitely. Note: This has been disputed by the vendor as not a vulnerability. They argue that this is an intended design.

Pritunl 1.29.2145.25 allows attackers to enumerate valid VPN usernames via a series of /auth/session login attempts. Initially, the server will return error 401. However, if the username is valid, then after 20 login attempts, the server will start responding with error 400. Invalid usernames will receive error 401 indefinitely. Note: This has been disputed by the vendor as not a vulnerability. They argue that this is an intended design

https://github.com/lukaszstu/pritunl/blob/master/CVE-2020-25200 Third Party Advisory

https://github.com/lukaszstu/pritunl/blob/master/CVE-2020-25200 Exploit, Third Party Advisory

CWE-200

CWE-203

Pritunl 1.29.2145.25 allows attackers to enumerate valid VPN usernames via a series of /auth/session login attempts. Initially, the server will return error 401. However, if the username is valid, then after 20 login attempts, the server will start responding with error 400. Invalid usernames will receive error 401 indefinitely.

** DISPUTED ** Pritunl 1.29.2145.25 allows attackers to enumerate valid VPN usernames via a series of /auth/session login attempts. Initially, the server will return error 401. However, if the username is valid, then after 20 login attempts, the server will start responding with error 400. Invalid usernames will receive error 401 indefinitely. Note: This has been disputed by the vendor as not a vulnerability. They argue that this is an intended design.

NIST AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

NIST (AV:N/AC:L/Au:N/C:P/I:N/A:N)

NIST CWE-200

OR
     *cpe:2.3:a:pritunl:pritunl:1.29.2145.25:*:*:*:*:*:*:*

https://github.com/lukaszstu/pritunl/blob/master/CVE-2020-25200 No Types Assigned

https://github.com/lukaszstu/pritunl/blob/master/CVE-2020-25200 Third Party Advisory

https://pritunl.com No Types Assigned

https://pritunl.com Vendor Advisory

https://pritunl.com/security No Types Assigned

https://pritunl.com/security Vendor Advisory