CVE-2021-41767

Published: Jan 11, 2022Modified: Jun 17, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

Apache Guacamole 1.3.0 and older may incorrectly include a private tunnel identifier in the non-private details of some REST responses. This may allow an authenticated user who already has permission to access a particular connection to read from or interact with another user's active use of that same connection.

Affected (1)

Products: Apache: Guacamole

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Apache Guacamole	Up to 1.3.0

Related CWEs

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (4)

http://www.openwall.com/lists/oss-security/2022/01/11/6

Source: security@apache.org

Mailing ListThird Party Advisory

https://lists.apache.org/thread/5l31k4jmzdsfz0xt8osrbl878gb3b7ro

Source: security@apache.org

Mailing ListVendor Advisory

http://www.openwall.com/lists/oss-security/2022/01/11/6

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

https://lists.apache.org/thread/5l31k4jmzdsfz0xt8osrbl878gb3b7ro

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListVendor Advisory

Timeline

No history available yet.