CVE-2023-30575: medium-severity vulnerability in Apache Guacamole
Apache Guacamole: Incorrect calculation of Guacamole protocol element lengths
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.5epss 1.0%
Apache Guacamole 1.5.1 and older may incorrectly calculate the lengths of instruction elements sent during the Guacamole protocol handshake, potentially allowing an attacker to inject Guacamole instructions during the handshake through specially-crafted data.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Affected products
Apache Software Foundation · Apache GuacamoleRelated CVEs — Apache Guacamole
In the same product, most dangerous first.
CVE-2018-1340—CVE-2018-1340EPSS 2.0%CVE-2021-41767—Private tunnel identifier may be included in the non-private details of active connectionsEPSS 2.0%CVE-2021-43999—Improper validation of SAML responsesEPSS 1.8%CVE-2017-3158—CVE-2017-3158EPSS 1.2%CVE-2023-30576MEDIUMApache Guacamole: Use-after-free in handling of RDP audio input bufferEPSS 1.1%CVE-2023-43826HIGHApache Guacamole: Integer overflow in handling of VNC image buffersEPSS 0.9%