Threat Investigation
Request a demo

CVE-2021-41767

Medium

Description

Apache Guacamole 1.3.0 and older may incorrectly include a private tunnel identifier in the non-private details of some REST responses. This may allow an authenticated user who already has permission to access a particular connection to read from or interact with another user's active use of that same connection.

SeverityMedium
CVSS6.5
Exploit probability—
ProductApache Guacamole
PublishedJan 11, 2022
First seenJan 11, 2022
Weakness typeCWE-200Sensitive information exposure

How to fix

Sources list no fixed version or patch link for this vulnerability.

Affected products

ProductAffected versionsFixed in
apache guacamolev ≤ 1.3.0—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.