Vulnerability in Apache Guacamole
CVE-2020-11997
Apache Guacamole 1.2.0 and earlier do not consistently restrict access to connection history based on user visibility. If multiple users share access to the same connection, those users may be able to see which other users have accessed that connection, as well as the IP addresses from which that connection was accessed, even if those users do not otherwise have permission to see other users.
EPSS: 0.012 (66.2th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N.
Affected products
- Apache Guacamole
- N/a Apache Guacamole — versions Apache Guacamole 1.2.0 and older
Weakness classification (CWE)
References
- security@apache.org (Mailing List, x_refsource_MISC, Vendor Advisory)
Frequently asked questions
- What is CVE-2020-11997?
- CVE-2020-11997 is a medium-severity vulnerability in Apache Guacamole, classified under Incorrect Default Permissions. CVSS score: 4.3/10. Published 2021-01-19.
- How severe is CVE-2020-11997?
- Medium severity. CVSS v3 base score is 4.3 out of 10.