CVE-2021-41767: Exposure of Sensitive Information to an Unauthorized Actor

January 11, 2022 (updated January 14, 2022)

Apache Guacamole may incorrectly include a private tunnel identifier in the non-private details of some REST responses. This may allow an authenticated user who already has permission to access a particular connection to read from or interact with another user’s active use of that same connection.

References

www.openwall.com/lists/oss-security/2022/01/11/6
lists.apache.org/thread/5l31k4jmzdsfz0xt8osrbl878gb3b7ro
nvd.nist.gov/vuln/detail/CVE-2021-41767

Code Behaviors & Features

Detect and mitigate CVE-2021-41767 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →