GitHub Advisoryadvisory · Maven

GHSA-wr7r-vg3c-54r5 Missing Encryption of Sensitive Data in Apache Guacamole

HIGH Published 2022-05-13 Modified 2022-11-03 Official page ↗
Aliases
CVE-2018-1340
Ecosystem
Maven
Packages
org.apache.guacamole:guacamole-common
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-311
Reviewed
2022-11-03

Affected packages

• Maven org.apache.guacamole:guacamole-common: < 1.0.0 → fixed in 1.0.0

Description

Prior to 1.0.0, Apache Guacamole used a cookie for client-side storage of the user's session token. This cookie lacked the "secure" flag, which could allow an attacker eavesdropping on the network to intercept the user's session token if unencrypted HTTP requests are made to the same domain.

Related

Alias · CVE (1)

  • CVE-2018-1340 Prior to 1.0.0, Apache Guacamole used a cookie for client-side storage of the user's session token. vulnerability

Weakness · CWE (1)

  • CWE-311 Missing Encryption of Sensitive Data weakness

References