Severity:

Medium
CVSS v3.1 base score:4.1
CVSS v3.1 vector:AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:H/RL:O/RC:C

Software affected

  • Glyptodon Enterprise 1.13 and older
  • Glyptodon Enterprise 2.1 and older

Description

Apache Guacamole 1.2.0 and older do not consistently restrict access to connection history based on user visibility. If multiple users share access to the same connection, those users may be able to see which other users have accessed that connection, as well as the IP addresses from which that connection was accessed, even if those users do not otherwise have permission to see other users.

Preconditions for exploitation

  • Multiple users that share access to the same connections.

Results of a successful attack

  • A user with access to a connection is able to see whether other users have accessed that connection, as well as the IP addresses used to access the connection.

Mitigation

Both Glyptodon Enterprise 1.x and 2.x have been patched with respect to this vulnerability. Users should evaluate their exposure/risk based on this advisory and plan to upgrade when possible.

Analysis and CVSS score breakdown

MetricValueComments
Attack VectorNetworkExploiting this vulnerability relies only on communicating with the web application through standard mechanisms, as already exposed by Guacamole's web interface.
Attack ComplexityLowExploiting this vulnerability requires limited technical ability, as the information in question is retrieved through standard mechanisms already exposed by Guacamole's web interface.
Privileges RequiredLowObtaining the information in question requires a user account with access to one or more connections. Information on connection usage can be retrieved only for connections accessible by the user.
User InteractionNoneAn attacker would require no additional user interaction beyond their own.
ScopeUnchangedThe scope of information obtained does not extend beyond what Guacamole is explicitly designed to provide.
Confidentiality ImpactLowRetrievable information is limited to the usernames of users that have accessed connections that the current user may also access, as well as the IP addresses used for those past accesses.
IntegrityNoneData integrity is in no way affected. The relevant information may be read, not modified.
AvailabilityNoneThe availability of Guacamole and all related services are unaffected.
ExploitabilityHighExploiting this vulnerability requires limited technical ability, as the information in question is retrieved through standard mechanisms already exposed by Guacamole's web interface.
Remediation LevelOfficial fix availableThe upstream Apache Guacamole project has released a fix via their 1.3.0 release, and this fix has been backported to all affected versions of Glyptodon Enterprise.
Report ConfidenceConfirmedExistence of the vulnerability in Apache Guacamole 1.2.0 and older has been acknowledged by the upstream Apache Guacamole project.