Read the docs
TI-2020-09656 Aliases CVE-2020-11997

Incorrect default permissions in Apache Guacamole

Priority LOW 23CWE-276Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · None · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

Apache Guacamole 1.2.0 and earlier do not consistently restrict access to connection history based on user visibility. If multiple users share access to the same connection, those users may be able to see which other users have accessed that connection, as well as the IP addresses from which that connection was accessed, even if those users do not otherwise have permission to see other users.

Why it matters now

EPSS 0.0126 69th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—Apache GuacamoleApache Guacamole 1.2.0 and older—No fix listedCNA
  • Apache Guacamole Vendor— Affected Apache Guacamole 1.2.0 and older Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:guacamole:*:*:*:*:*:*:*:*up to 1.2.0VulnerableApache
  • cpe:2.3:a:apache:guacamole:*:*:*:*:*:*:*:* Versions up to 1.2.0 Vulnerable ·Apache

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-11997

References

Advisory 1

  • TI-2019-14123 SQLite 3.30.1 mishandles certain SELECT statements with a nonexistent VIEW, leading to an application crash. CVSS 3.1HIGH 7.5
  • TI-2023-23512 Apache Guacamole: Integer overflow in handling of VNC image buffers CVSS 3.1HIGH 8.8
  • TI-2021-19751 Improper validation of SAML responses CVSS 3.1HIGH 8.8
  • TI-2023-14404 Apache Guacamole: Use-after-free in handling of RDP audio input buffer CVSS 3.1HIGH 8.1
  • TI-2017-02374 Race condition in Apache Guacamole CVSS 3.0HIGH 8.1
  • TI-2018-01241 Prior to 1.0.0, Apache Guacamole used a cookie for client-side storage of the user's… CVSS 3.0HIGH 7.5
See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences