Vulnerability · Published Jul 2, 2020 · Assigned by apache
CVE-2020-9497
Medium 4.4
In plain English
A medium-severity security flaw in Apache Guacamole. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 57% of all known vulnerabilities).
Severity (CVSS NVD)4.4Medium
Exploit odds (30 days)0.8%top 43.5% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Apache Guacamole 1.1.0 and older do not properly validate datareceived from RDP servers via static virtual channels. If a userconnects to a malicious or compromised RDP server, specially-craftedPDUs could result in disclosure of information within the memory ofthe guacd process handling the connection.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | Apache Guacamole | Apache Guacamole 1.1.0 and older |
References
- https://lists.apache.org/thread.html/r65f75d3d65d1af68141f42071ebb27dda24af3e45570e593c1dbd81f%40%3Cannounce.guacamole.apache.org%3E x_refsource_MISC
- [announce] 20200701 [SECURITY] CVE-2020-9497: Apache Guacamole: Improper input validation of RDP static virtual channels mailing-list, x_refsource_MLIST
- [guacamole-user] 20200703 Re: [SECURITY] CVE-2020-9497: Apache Guacamole: Improper input validation of RDP static virtual channels mailing-list, x_refsource_MLIST
- [guacamole-user] 20200703 RE: [SECURITY] CVE-2020-9497: Apache Guacamole: Improper input validation of RDP static virtual channels mailing-list, x_refsource_MLIST
- https://research.checkpoint.com/2020/apache-guacamole-rce/ x_refsource_MISC
- https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44525 x_refsource_CONFIRM
- [debian-lts-announce] 20201106 [SECURITY] [DLA 2435-1] guacamole-server security update mailing-list, x_refsource_MLIST
- FEDORA-2020-bfde0ab889 vendor-advisory, x_refsource_FEDORA
- FEDORA-2020-640645e518 vendor-advisory, x_refsource_FEDORA
- [announce] 20210125 Apache Software Foundation Security Report: 2020 mailing-list, x_refsource_MLIST
- [announce] 20210223 Re: Apache Software Foundation Security Report: 2020 mailing-list, x_refsource_MLIST