CVE-2023-30575

Published Jun 7, 2023

Last updated a year ago

Overview

Description: Apache Guacamole 1.5.1 and older may incorrectly calculate the lengths of instruction elements sent during the Guacamole protocol handshake, potentially allowing an attacker to inject Guacamole instructions during the handshake through specially-crafted data.
Source: security@apache.org
NVD status: Modified

Risk scores

CVSS 3.1

Type: Primary
Base score: 7.5
Impact score: 3.6
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Severity: HIGH

Weaknesses

security@apache.org: CWE-131
nvd@nist.gov: CWE-131

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:apache:guacamole:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "AE5D0D8B-CE5F-4168-A1CB-4872610F5B67",
            "versionEndExcluding": "1.5.2"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References