CVE-2023-30576

2023-06-0709:15:10

CWE-416

[email protected]

web.nvd.nist.gov

cve-2023-30576

apache guacamole

arbitrary code execution

nvd

security vulnerability

8.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

8.3 High

AI Score

Confidence

High

0.005 Low

EPSS

Percentile

75.5%

JSON

Apache Guacamole 0.9.10 through 1.5.1 may continue to reference a freed RDP audio input buffer. Depending on timing, this may allow an attacker to execute arbitrary code with the privileges of the guacd process.

Affected configurations

Vulners

NVD

Node

apacheguacamoleRange≤1.5.1

CPENameOperatorVersion
apache:guacamoleapache guacamolelt1.5.2

CPE	Name	Operator	Version
apache:guacamole	apache guacamole	lt	1.5.2

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Apache Guacamole",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThanOrEqual": "1.5.1",
        "status": "affected",
        "version": "0.9.10",
        "versionType": "semver"
      }
    ]
  }
]