CVE-2025-50055 - Vulnerability Details - OpenCVE

Cross-site scripting (XSS) vulnerability in the SAML Authentication module in OpenVPN Access Server version 2.14.0 through 2.14.3 allows configured remote SAML Assertion Consumer Service (ACS) endpoint servers to inject arbitrary web script or HTML via the RelayState parameter

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Openvpn	Openvpn Openvpn Access Server

No data.

No data.

References

Link	Providers
https://openvpn.net/as-docs/as-3-0-release-notes.html#access-server-3-0-0

History

Thu, 30 Oct 2025 19:15:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 6.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mon, 27 Oct 2025 22:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Openvpn Openvpn openvpn Openvpn openvpn Access Server
Vendors & Products		Openvpn Openvpn openvpn Openvpn openvpn Access Server

Mon, 27 Oct 2025 13:45:00 +0000

Type	Values Removed	Values Added
Description		Cross-site scripting (XSS) vulnerability in the SAML Authentication module in OpenVPN Access Server version 2.14.0 through 2.14.3 allows configured remote SAML Assertion Consumer Service (ACS) endpoint servers to inject arbitrary web script or HTML via the RelayState parameter
Weaknesses		CWE-79
References		https://openvpn.net/as-docs/as-3-0-release-notes.html#access-server-3-0-0

MITRE

Status: PUBLISHED

Assigner: OpenVPN

Published: 2025-10-27T13:39:43.652Z

Updated: 2025-10-30T18:23:58.634Z

Reserved: 2025-06-11T17:29:58.718Z

Link: CVE-2025-50055

Vulnrichment

Updated: 2025-10-30T18:23:54.490Z

NVD

Status : Awaiting Analysis

Published: 2025-10-27T14:15:40.687

Modified: 2025-10-30T19:16:24.857

Link: CVE-2025-50055

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-50055", "assignerOrgId": "36a55730-e66d-4d39-8ca6-3c3b3017965e", "state": "PUBLISHED", "assignerShortName": "OpenVPN", "dateReserved": "2025-06-11T17:29:58.718Z", "datePublished": "2025-10-27T13:39:43.652Z", "dateUpdated": "2025-10-30T18:23:58.634Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "36a55730-e66d-4d39-8ca6-3c3b3017965e", "shortName": "OpenVPN", "dateUpdated": "2025-10-27T13:39:43.652Z"}, "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "affected": [{"vendor": "OpenVPN", "product": "Access Server", "versions": [{"status": "affected", "version": "2.14.0", "lessThanOrEqual": "2.14.3", "versionType": "semver"}], "defaultStatus": "unaffected"}], "cpeApplicability": [{"operator": "OR", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:openvpn:access_server:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.14.0", "versionEndIncluding": "2.14.3"}]}]}], "descriptions": [{"lang": "en", "value": "Cross-site scripting (XSS) vulnerability in the SAML Authentication module in OpenVPN Access Server version 2.14.0 through 2.14.3 allows configured remote SAML Assertion Consumer Service (ACS) endpoint servers to inject arbitrary web script or HTML via the RelayState parameter"}], "references": [{"url": "https://openvpn.net/as-docs/as-3-0-release-notes.html#access-server-3-0-0"}], "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-10-30T18:23:34.406354Z", "id": "CVE-2025-50055", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-30T18:23:58.634Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-50055", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-30T18:23:34.406354Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-30T18:23:54.490Z"}}], "cna": {"affected": [{"vendor": "OpenVPN", "product": "Access Server", "versions": [{"status": "affected", "version": "2.14.0", "versionType": "semver", "lessThanOrEqual": "2.14.3"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://openvpn.net/as-docs/as-3-0-release-notes.html#access-server-3-0-0"}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "Cross-site scripting (XSS) vulnerability in the SAML Authentication module in OpenVPN Access Server version 2.14.0 through 2.14.3 allows configured remote SAML Assertion Consumer Service (ACS) endpoint servers to inject arbitrary web script or HTML via the RelayState parameter"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:openvpn:access_server:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndIncluding": "2.14.3", "versionStartIncluding": "2.14.0"}], "operator": "OR"}], "operator": "OR"}], "providerMetadata": {"orgId": "36a55730-e66d-4d39-8ca6-3c3b3017965e", "shortName": "OpenVPN", "dateUpdated": "2025-10-27T13:39:43.652Z"}}}, "cveMetadata": {"cveId": "CVE-2025-50055", "state": "PUBLISHED", "dateUpdated": "2025-10-30T18:23:58.634Z", "dateReserved": "2025-06-11T17:29:58.718Z", "assignerOrgId": "36a55730-e66d-4d39-8ca6-3c3b3017965e", "datePublished": "2025-10-27T13:39:43.652Z", "assignerShortName": "OpenVPN"}, "dataVersion": "5.2"}