PT-2019-8967 · Apache · Apache Guacamole

Ross Golder · Publicado 2019-02-07 · Atualizado 2022-05-13 · CVE-2018-1340

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Guacamole versions prior to 1.0.0

Description The issue concerns the use of a cookie for client-side storage of the user's session token. This cookie lacks the "secure" flag, which could allow an attacker eavesdropping on the network to intercept the user's session token if unencrypted HTTP requests are made to the same domain.

Recommendations For versions prior to 1.0.0, update to version 1.0.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the application over unencrypted HTTP to minimize the risk of session token interception.

Correção

Missing Encryption of Sensitive Data

Enumeração de Fraquezas

CWE-311

Identificadores relacionados

CVE-2018-1340

GHSA-WR7R-VG3C-54R5

MGASA-2021-0272

Produtos afetados

Apache Guacamole

Referências · 18

• https://osv.dev/vulnerability/CVE-2018-1340 · Aviso do Fabricante
• https://bugs.mageia.org/show_bug.cgi?id=24509 · Nota
• https://advisories.mageia.org/MGASA-2021-0272.html · Nota de Segurança
• http://securityfocus.com/bid/106768 · Nota
• https://osv.dev/vulnerability/GHSA-wr7r-vg3c-54r5 · Aviso do Fabricante
• https://osv.dev/vulnerability/MGASA-2021-0272 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-1340 · Nota de Segurança
• https://bugs.mageia.org/show_bug.cgi?id=27593 · Nota
• https://bugs.mageia.org/show_bug.cgi?id=28158 · Nota
• https://ubuntu.com/security/CVE-2018-1340 · Aviso do Fabricante
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/32RWZPQ7FRP73BVKOQK27XV6TX47TT3R · Aviso do Fabricante
• https://lists.apache.org/thread.html/af1632e13dd9acf7537546660cae9143cbb10fdd2f9bb0832a690979%40%3Cannounce.guacamole.apache.org%3E · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-1340 · Aviso do Fabricante
• https://openwall.com/lists/oss-security/2021/01/18/1 · Nota
• https://cve.org/CVERecord?id=CVE-2018-1340 · Nota de Segurança