CVE-2020-11997
Last modified
CVE-2020-11997 is a medium-severity vulnerability rated 4.3/10 on the CVSS scale. Apache Guacamole 1.2.0 and earlier do not consistently restrict access to connection history based on user visibility. If multiple users share access to the same connection, those users may be able to see which other users have accessed that connection, as well as the IP addresses from which that connection was accessed, even if those users do not otherwise have permission to see other users.. EPSS estimates a 1.24% chance of exploitation in the next 30 days.
Description
Apache Guacamole 1.2.0 and earlier do not consistently restrict access to connection history based on user visibility. If multiple users share access to the same connection, those users may be able to see which other users have accessed that connection, as well as the IP addresses from which that connection was accessed, even if those users do not otherwise have permission to see other users.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Apache | Guacamole | <= 1.2.0 |
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2020-11997?
How severe is CVE-2020-11997?
How do I fix CVE-2020-11997?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2020
- CVE-2020-11991When using the StreamGenerator, the code parse a user-provid…7.5
- CVE-2020-11992Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2020-11993Apache HTTP Server versions 2.4.20 to 2.4.43 When trace/debu…7.5
- CVE-2020-11994Server-Side Template Injection and arbitrary file disclosure…7.5
- CVE-2020-11995A deserialization vulnerability existed in dubbo 2.7.5 and i…9.8
- CVE-2020-11996A specially crafted sequence of HTTP/2 requests sent to Apac…7.5
- CVE-2020-11998A regression has been introduced in the commit preventing JM…9.8
- CVE-2020-11999FactoryTalk Linx versions 6.00, 6.10, and 6.11, RSLinx Class…8.1
- CVE-2020-1200<p>A remote code execution vulnerability exists in Microsoft…8.6
- CVE-2020-12000The affected product is vulnerable to the handling of serial…7.5
- CVE-2020-12001FactoryTalk Linx versions 6.00, 6.10, and 6.11, RSLinx Class…9.8
- CVE-2020-12002Advantech WebAccess Node, Version 8.4.4 and prior, Version 9…9.8
Are you affected by CVE-2020-11997?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST