Read the docs
TI-2018-01241 Aliases CVE-2018-1340GHSA-wr7r-vg3c-54r5

Prior to 1.0.0, Apache Guacamole used a cookie for client-side storage of the user's…

Priority LOW 37CWE-311Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-311.

Summary

Prior to 1.0.0, Apache Guacamole used a cookie for client-side storage of the user's session token. This cookie lacked the "secure" flag, which could allow an attacker eavesdropping on the network to intercept the user's session token if unencrypted HTTP requests are made to the same domain.

Why it matters now

EPSS 0.02043 81st percentileScored 2026-11-07
Fix Fixed org.apache.guacamole:guacamole-common (Maven): 1.0.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache GuacamoleApache Guacamole 0.9.4 to 0.9.14—No fix listedCNA
—org.apache.guacamole:guacamole-common (Maven)before 1.0.01.0.0Patch availableGHSA-wr7r-vg3c-54r5
  • Apache Guacamole VendorApache Affected Apache Guacamole 0.9.4 to 0.9.14 Fixed in — No fix listed CNA
  • org.apache.guacamole:guacamole-common (Maven) Vendor— Affected before 1.0.0 Fixed in 1.0.0 Patch available GHSA-wr7r-vg3c-54r5

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:guacamole:*:*:*:*:*:*:*:*up to 0.9.14VulnerableApache
  • cpe:2.3:a:apache:guacamole:*:*:*:*:*:*:*:* Versions up to 0.9.14 Vulnerable ·Apache

Remediation

  • Fix · GHSA-wr7r-vg3c-54r5 org.apache.guacamole:guacamole-common (Maven) Fixed in 1.0.0 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-1340
  2. 2026-10-03 Alias added: GHSA-wr7r-vg3c-54r5

References

Advisory 1

Other 2

  • TI-2019-14123 SQLite 3.30.1 mishandles certain SELECT statements with a nonexistent VIEW, leading to an application crash. CVSS 3.1HIGH 7.5
  • TI-2023-23512 Apache Guacamole: Integer overflow in handling of VNC image buffers CVSS 3.1HIGH 8.8
  • TI-2021-19751 Improper validation of SAML responses CVSS 3.1HIGH 8.8
  • TI-2023-14404 Apache Guacamole: Use-after-free in handling of RDP audio input buffer CVSS 3.1HIGH 8.1
  • TI-2017-02374 Race condition in Apache Guacamole CVSS 3.0HIGH 8.1
  • TI-2024-23239 Apache Guacamole: Improper input validation of console codes CVSS 3.1HIGH 7.5
See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences