GHSA-wr7r-vg3c-54r5

ghsaUSosv

Missing Encryption of Sensitive Data in Apache Guacamole

view advisory published 2022-05-13Licence: CC-BY-4.0

Prior to 1.0.0, Apache Guacamole used a cookie for client-side storage of the user's session token. This cookie lacked the "secure" flag, which could allow an attacker eavesdropping on the network to intercept the user's session token if unencrypted HTTP requests are made to the same domain.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2018-1340US	high7.5OT elevated	2.04% (81st)	—	2019-02-07
Prior to 1.0.0, Apache Guacamole used a cookie for client-side storage of the user's session token. This cookie lacked the "secure" flag, which could allow an attacker eavesdroppin…

references

External citations — patches, advisories, analysis.

http://www.securityfocus.com/bid/106768WEB
https://lists.apache.org/thread.html/af1632e13dd9acf7537546660cae9143cbb10fdd2f9bb0832a690979@%3Cannounce.guacamole.apache.org%3EWEB
https://nvd.nist.gov/vuln/detail/CVE-2018-1340ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan