CVE-2020-25200 - CVE House
Back to Database
Status published Medium CVE-2020-25200

Pritunl 1.29.2145.25 allows attackers to enumerate valid VPN usernames via...

Vulnerability Description

Pritunl 1.29.2145.25 allows attackers to enumerate valid VPN usernames via a series of /auth/session login attempts. Initially, the server will return error 401. However, if the username is valid, then after 20 login attempts, the server will start responding with error 400. Invalid usernames will receive error 401 indefinitely. Note: This has been disputed by the vendor as not a vulnerability. They argue that this is an intended design

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-25200

Credits & Attribution

No credits recorded in the NVD database.

References

More from pritunl

View All →
CVE-2022-25372
Pritunl Client through 1.2.3019.52 on Windows allows local privilege escalation,...
High 7.8
CVE-2020-27519
Pritunl Client v1.2.2550.20 contains a local privilege escalation vulnerability in...
High 7.8
CVE-2020-25989
Privilege escalation via arbitrary file write in pritunl electron client...
High 7.8

Affected Vendor

Affected Software

pritunl
Vulnerable Versions:
1.29.2145.25

Timeline

Official Publish: October 1st, 2020
Last Modified: November 18th, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.