Apache Guacamole 1.3.0 and older may incorrectly include a private tunnel identifier in the non-private details of some REST responses. This may allow an authenticated user who already has permission to access a particular connection to read from or interact with another user’s active use of that same connection.
[
{
"product": "Apache Guacamole",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThanOrEqual": "1.3.0",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
]