CVE-2021-41767: falha em Apache Guacamole
Private tunnel identifier may be included in the non-private details of active connections
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
3Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackepss 2.0%
Apache Guacamole 1.3.0 and older may incorrectly include a private tunnel identifier in the non-private details of some REST responses. This may allow an authenticated user who already has permission to access a particular connection to read from or interact with another user's active use of that same connection.
Produtos afetados
Apache Software Foundation · Apache GuacamoleCVEs relacionadas — Apache Guacamole
No mesmo produto, das mais perigosas para as menos.
CVE-2018-1340—CVE-2018-1340EPSS 2.0%CVE-2021-43999—Improper validation of SAML responsesEPSS 1.8%CVE-2017-3158—CVE-2017-3158EPSS 1.2%CVE-2023-30576MEDIUMApache Guacamole: Use-after-free in handling of RDP audio input bufferEPSS 1.1%CVE-2023-30575MEDIUMApache Guacamole: Incorrect calculation of Guacamole protocol element lengthsEPSS 1.0%CVE-2023-43826HIGHApache Guacamole: Integer overflow in handling of VNC image buffersEPSS 0.9%