Private tunnel identifier may be included in the non-private details of active connections
Vulnerability Description
Apache Guacamole 1.3.0 and older may incorrectly include a private tunnel identifier in the non-private details of some REST responses. This may allow an authenticated user who already has permission to access a particular connection to read from or interact with another user's active use of that same connection.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-41767
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- We would like to thank Damian Velardo (Australia and New Zealand Banking Group) for reporting this issue.
References
More from Apache Software Foundation
View All →Affected Vendor
Apache Software Foundation
View all reports →