Homepage About Snyk

Remote Code Execution (RCE) Affecting org.apache.guacamole:guacamole package, versions [,1.2.0)

0.0
high

  • Attack Complexity

    High

  • Confidentiality

    High

  • Integrity

    High

  • Availability

    High

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

  • snyk-id

    SNYK-JAVA-ORGAPACHEGUACAMOLE-575220

  • published

    2 Jul 2020

  • disclosed

    2 Jul 2020

  • credit

    Unknown

Report a new vulnerability Found a mistake?

Introduced: 2 Jul 2020

CVE-2020-9498 Open this link in a new tab
CWE-94 Open this link in a new tab

How to fix?

Upgrade org.apache.guacamole:guacamole to version 1.2.0 or higher.

Overview

org.apache.guacamole:guacamole is a clientless remote desktop gateway.

Affected versions of this package are vulnerable to Remote Code Execution (RCE). The package may mishandle pointers involved in processing data received via RDP static virtual channels. If a user connects to a malicious or compromised RDP server, a series of specially-crafted PDUs could result in memory corruption, possibly allowing arbitrary code to be executed with the privileges of the running process.