|CVSS v3.1 base score:||4.1|
|CVSS v3.1 vector:||AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:H/RL:O/RC:C|
- Glyptodon Enterprise 1.13 and older
- Glyptodon Enterprise 2.1 and older
Apache Guacamole 1.2.0 and older do not consistently restrict access to connection history based on user visibility. If multiple users share access to the same connection, those users may be able to see which other users have accessed that connection, as well as the IP addresses from which that connection was accessed, even if those users do not otherwise have permission to see other users.
Preconditions for exploitation
- Multiple users that share access to the same connections.
Results of a successful attack
- A user with access to a connection is able to see whether other users have accessed that connection, as well as the IP addresses used to access the connection.
Both Glyptodon Enterprise 1.x and 2.x have been patched with respect to this vulnerability. Users should evaluate their exposure/risk based on this advisory and plan to upgrade when possible.
Analysis and CVSS score breakdown
|Attack Vector||Network||Exploiting this vulnerability relies only on communicating with the web application through standard mechanisms, as already exposed by Guacamole's web interface.|
|Attack Complexity||Low||Exploiting this vulnerability requires limited technical ability, as the information in question is retrieved through standard mechanisms already exposed by Guacamole's web interface.|
|Privileges Required||Low||Obtaining the information in question requires a user account with access to one or more connections. Information on connection usage can be retrieved only for connections accessible by the user.|
|User Interaction||None||An attacker would require no additional user interaction beyond their own.|
|Scope||Unchanged||The scope of information obtained does not extend beyond what Guacamole is explicitly designed to provide.|
|Confidentiality Impact||Low||Retrievable information is limited to the usernames of users that have accessed connections that the current user may also access, as well as the IP addresses used for those past accesses.|
|Integrity||None||Data integrity is in no way affected. The relevant information may be read, not modified.|
|Availability||None||The availability of Guacamole and all related services are unaffected.|
|Exploitability||High||Exploiting this vulnerability requires limited technical ability, as the information in question is retrieved through standard mechanisms already exposed by Guacamole's web interface.|
|Remediation Level||Official fix available||The upstream Apache Guacamole project has released a fix via their 1.3.0 release, and this fix has been backported to all affected versions of Glyptodon Enterprise.|
|Report Confidence||Confirmed||Existence of the vulnerability in Apache Guacamole 1.2.0 and older has been acknowledged by the upstream Apache Guacamole project.|