Vulnerability · Published Jun 7, 2023 · Assigned by apache
CVE-2023-30576Apache Guacamole: Use-after-free in handling of RDP audio input buffer
Medium 6.8
In plain English
A medium-severity use-after-free in Apache Guacamole from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 66% of all known vulnerabilities).
Severity (CVSS 3.1)6.8Medium
Exploit odds (30 days)1.1%top 33.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Apache Guacamole 0.9.10 through 1.5.1 may continue to reference a freed RDP audio input buffer. Depending on timing, this may allow an attacker to execute arbitrary code with the privileges of the guacd process.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache Guacamole | 0.9.10 – through 1.5.1 |
Weakness: CWE-416 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
References
- https://lists.apache.org/thread/vgtvxb3w7mm84hx6v8dfc0onsoz05gb6 vendor-advisory