CVE-2021-41767CWE-200

Private tunnel identifier may be included in the non-private details of active connections

published January 11, 2022

CVSS
—
EPSS
2%
Percentile
79.9
In the wild
Unconfirmed
What it is

Apache Guacamole 1.3.0 and older may incorrectly include a private tunnel identifier in the non-private details of some REST responses. This may allow an authenticated user who already has permission to access a particular connection to read from or interact with another user's active use of that same connection.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01933 · 79.9th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2022-01-11T22:10Z
EPSS history
Timeline
  • 11 JAN 22:10Z
    Private tunnel identifier may be included in the non-private details of active connections
    cvelistv5