description: OpenVPN Connect versions before 3.4.0.4506 (macOS) and OpenVPN Connect before 3.4.0.3100 (Windows) allows man-in-the-middle attackers to intercept configuration profile download requests which contains the users credentials
problem types: CWE-295 Improper Certificate Validation
affected:
{
vendor: OpenVPN Inc
product: OpenVPN Connect
platforms: [Windows, MacOS]
versions:
status: affected, version: until 3.4.0.4506, lessThan: 3.4.0.4506, versionType: macOS
status: affected, version: until 3.4.0.3100, lessThan: 3.4.0.3100, versionType: Windows
defaultStatus: affected
}