CVE-2023-36672

Katalog CVE

CVSS 5.7 · Medium EPSS 0,54%

Kerentanan Cleartext Transmission of Sensitive Information pada clario vpn. Skor CVSS 3.1 5.7 (Medium) menurut NVD.

Deskripsi (NVD)

An issue was discovered in the Clario VPN client through 5.9.1.1662 for macOS. The VPN client insecurely configures the operating system such that traffic to the local network is sent in plaintext outside the VPN tunnel even if the local network is using a non-RFC1918 IP subnet. This allows an adversary to trick the victim into sending arbitrary IP traffic in plaintext outside the VPN tunnel. NOTE: the tunnelcrack.mathyvanhoef.com website uses this CVE ID to refer more generally to "LocalNet attack resulting in leakage of traffic in plaintext" rather than to only Clario.

Rincian

Terbit di NVD

9 Agustus 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.7 (Medium), sumber NVD
CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-319: Cleartext Transmission of Sensitive Information

EPSS (30 hari)

0,54% peluang dieksploitasi; lebih tinggi dari 43,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://mullvad.net/de/blog/2023/8/9/response-to-tunnelcrack-vulnerability-disclosure/ advisory pihak ketiga
• https://tunnelcrack.mathyvanhoef.com/details.html exploit · advisory pihak ketiga
• https://clario.co/vpn-for-mac/ product
• https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0015