CVE-2021-41767 Private tunnel identifier may be included in the non-private details of active connections
Authenticated users can read private tunnel identifiers to access other users' active connections, compromising session isolation in Apache Guacamole.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-41767?
CVE-2021-41767 is a medium-severity vulnerability in Apache Guacamole, published on 11 Jan 2022. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Apache Guacamole 1.3.0 and older may incorrectly include a private tunnel identifier in the non-private details of some REST responses. This may allow an authenticated user who already has permission to access a particular connection to read from or interact with another user's active use of that same connection.
Weakness: CWE-200
Which versions are affected by CVE-2021-41767?
2 open source packages ship an affected version, including guacamole and guacamole-server. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
guacamole Bitnami | All versions | 1.3.0 |
guacamole-server Bitnami | All versions | 1.3.0 |
Products include Apache Guacamole.
How do I fix CVE-2021-41767?
Upgrade guacamole to 1.3.0 or later.
Is CVE-2021-41767 being exploited?
There is no known exploitation of CVE-2021-41767 in the wild and no public exploit code.
Other vulnerabilities in Apache Guacamole
- CVE-2021-43999 Improper validation of SAML responses
- CVE-2017-3158 Apache Guacamole Race Condition vulnerability
- CVE-2023-43826 Apache Guacamole: Integer overflow in handling of VNC image buffers
- CVE-2019-19603 Null dereference in n/a
- CVE-2018-1340 Missing Encryption of Sensitive Data in Apache Guacamole
Sources
Also known as BIT-guacamole-2021-41767, BIT-guacamole-server-2021-41767, GHSA-8jvg-8759-x9j6, UBUNTU-CVE-2021-41767.