CVE-2021-43999CWE-287

CVE-2021-43999: vulnerability in Apache Guacamole

Improper validation of SAML responses

Published · Updated

Follow this CVE+ Monitor Apache Guacamole

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

3Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackepss 1.8%
Apache Guacamole 1.2.0 and 1.3.0 do not properly validate responses received from a SAML identity provider. If SAML support is enabled, this may allow a malicious user to assume the identity of another Guacamole user.
Affected products
Apache Software Foundation · Apache Guacamole
Related CVEs — Apache Guacamole

In the same product, most dangerous first.

CVE-2018-1340—CVE-2018-1340EPSS 2.0%CVE-2021-41767—Private tunnel identifier may be included in the non-private details of active connectionsEPSS 2.0%CVE-2017-3158—CVE-2017-3158EPSS 1.2%CVE-2023-30576MEDIUMApache Guacamole: Use-after-free in handling of RDP audio input bufferEPSS 1.1%CVE-2023-30575MEDIUMApache Guacamole: Incorrect calculation of Guacamole protocol element lengthsEPSS 1.0%CVE-2023-43826HIGHApache Guacamole: Integer overflow in handling of VNC image buffersEPSS 0.9%