CVE-2023-30575
Assigner: apache
Published: 2023-06-07T08:06:36.061Z
State: PUBLISHED
affected: defaultStatus: unaffected
product: Apache Guacamole
vendor: Apache Software Foundation
versions: lessThanOrEqual: 1.5.1
status: affected
version: 0
versionType: semver
credits: type: finder
value: Stefan Schiller (Sonar)
descriptions: supportingMedia: base64: no
type: text/html
value: Apache Guacamole 1.5.1 and older may incorrectly calculate the lengths of instruction elements sent during the Guacamole protocol handshake, potentially allowing an attacker to inject Guacamole instructions during the handshake through specially-crafted data.<br><br>
value: Apache Guacamole 1.5.1 and older may incorrectly calculate the lengths of instruction elements sent during the Guacamole protocol handshake, potentially allowing an attacker to inject Guacamole instructions during the handshake through specially-crafted data.


metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
version: 3.1
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-131
description: CWE-131 Incorrect Calculation of Buffer Size
type: CWE
source: discovery: EXTERNAL
timeline: time: 2023-04-11T14:51:00.000Z
value: Reported to security@guacamole.apache.org
time: 2023-04-11T15:07:00.000Z
value: Report acknowledged by project
time: 2023-04-11T19:46:00.000Z
value: Report confirmed by project
time: 2023-05-08T22:01:00.000Z
value: Fix completed and merged
time: 2023-05-09T10:32:00.000Z
value: Fix tested and confirmed by reporter
time: 2023-05-25T05:19:00.000Z
value: Fix released
title: Apache Guacamole: Incorrect calculation of Guacamole protocol element lengths
x_generator: engine: Vulnogram 0.1.0-dev