Riskcovery

CVE-2021-41767

Private tunnel identifier may be included in the non-private details of active connections

State
Published
Severity
Not scored
Published
Jan 11, 2022
Updated
Aug 4, 2024
Reserved
Sep 28, 2021

Read the record on cve.org

Description

Apache Guacamole 1.3.0 and older may incorrectly include a private tunnel identifier in the non-private details of some REST responses. This may allow an authenticated user who already has permission to access a particular connection to read from or interact with another user's active use of that same connection.

Scores

The record has no CVSS score.

Weaknesses

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

Affected Products

ProductVersions
Apache GuacamoleApache Software Foundation
  • 1.3.0 and earlierAffected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.