PT-2019-8967 · Apache · Apache Guacamole

Ross Golder · Published 2019-02-07 · Updated 2022-05-13 · CVE-2018-1340

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Guacamole versions prior to 1.0.0

Description The issue concerns the use of a cookie for client-side storage of the user's session token. This cookie lacks the "secure" flag, which could allow an attacker eavesdropping on the network to intercept the user's session token if unencrypted HTTP requests are made to the same domain.

Recommendations For versions prior to 1.0.0, update to version 1.0.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the application over unencrypted HTTP to minimize the risk of session token interception.

Fix

Missing Encryption of Sensitive Data

Weakness Enumeration

CWE-311

Related Identifiers

CVE-2018-1340

GHSA-WR7R-VG3C-54R5

MGASA-2021-0272

Affected Products

Apache Guacamole

References · 18

• https://osv.dev/vulnerability/CVE-2018-1340 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2021-0272.html · Security Note
• https://osv.dev/vulnerability/GHSA-wr7r-vg3c-54r5 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2021-0272 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-1340 · Security Note
• https://ubuntu.com/security/CVE-2018-1340 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/32RWZPQ7FRP73BVKOQK27XV6TX47TT3R · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-1340 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-1340 · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/WNS7UHBOFV6JHWH5XOEZTE3BREGRSSQ3 · Vendor Advisory
• https://bugs.mageia.org/show_bug.cgi?id=24509 · Note
• http://securityfocus.com/bid/106768 · Note
• https://bugs.mageia.org/show_bug.cgi?id=27593 · Note
• https://bugs.mageia.org/show_bug.cgi?id=28158 · Note
• https://lists.apache.org/thread.html/af1632e13dd9acf7537546660cae9143cbb10fdd2f9bb0832a690979%40%3Cannounce.guacamole.apache.org%3E · Note