CVE-2021-41767: vulnerability in Apache Guacamole
Private tunnel identifier may be included in the non-private details of active connections
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
3Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackepss 2.0%
Apache Guacamole 1.3.0 and older may incorrectly include a private tunnel identifier in the non-private details of some REST responses. This may allow an authenticated user who already has permission to access a particular connection to read from or interact with another user's active use of that same connection.
Affected products
Apache Software Foundation · Apache GuacamoleRelated CVEs — Apache Guacamole
In the same product, most dangerous first.
CVE-2018-1340—CVE-2018-1340EPSS 2.0%CVE-2021-43999—Improper validation of SAML responsesEPSS 1.8%CVE-2017-3158—CVE-2017-3158EPSS 1.2%CVE-2023-30576MEDIUMApache Guacamole: Use-after-free in handling of RDP audio input bufferEPSS 1.1%CVE-2023-30575MEDIUMApache Guacamole: Incorrect calculation of Guacamole protocol element lengthsEPSS 1.0%CVE-2023-43826HIGHApache Guacamole: Integer overflow in handling of VNC image buffersEPSS 0.9%