CVE-2023-43826

2023-12-1920:15:08

CWE-190

[email protected]

web.nvd.nist.gov

cve-2023-43826

apache

guacamole

integer overflow

vulnerability

nvd

security update

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8.8 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

55.4%

JSON

Apache Guacamole 1.5.3 and older do not consistently ensure that values received from a VNC server will not result in integer overflow. If a user connects to a malicious or compromised VNC server, specially-crafted data could result in memory corruption, possibly allowing arbitrary code to be executed with the privileges of the running guacd process.

Users are recommended to upgrade to version 1.5.4, which fixes this issue.

Affected configurations

Vulners

NVD

Node

apacheguacamoleRange≤1.5.3

CPENameOperatorVersion
apache:guacamoleapache guacamolele1.5.3

CPE	Name	Operator	Version
apache:guacamole	apache guacamole	le	1.5.3

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Apache Guacamole",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThanOrEqual": "1.5.3",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  }
]