CVE-2023-30575
Last modified
CVE-2023-30575 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. Apache Guacamole 1.5.1 and older may incorrectly calculate the lengths of instruction elements sent during the Guacamole protocol handshake, potentially allowing an attacker to inject Guacamole instructions during the handshake through specially-crafted data. . EPSS estimates a 1.16% chance of exploitation in the next 30 days.
Description
Apache Guacamole 1.5.1 and older may incorrectly calculate the lengths of instruction elements sent during the Guacamole protocol handshake, potentially allowing an attacker to inject Guacamole instructions during the handshake through specially-crafted data.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Apache | Guacamole | < 1.5.2 |
References
- https://lists.apache.org/thread/tn63n2lon0h5p45oft834t1dqvvxownvMailing List, Third Party Advisory
- https://lists.apache.org/thread/tn63n2lon0h5p45oft834t1dqvvxownvMailing List, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2023-30575?
How severe is CVE-2023-30575?
How do I fix CVE-2023-30575?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2023
- CVE-2023-30563A malicious file could be uploaded into a System Manager Use…8.2
- CVE-2023-30564Alaris Systems Manager does not perform input validation dur…6.9
- CVE-2023-30565An insecure connection between Systems Manager and CQI Repor…3.5
- CVE-2023-3057A vulnerability was found in YFCMF up to 3.0.4. It has been …9.8
- CVE-2023-30570pluto in Libreswan before 4.11 allows a denial of service (r…7.5
- CVE-2023-30571Libarchive through 3.6.2 can cause directories to have world…5.3
- CVE-2023-30576Apache Guacamole 0.9.10 through 1.5.1 may continue to refere…8.1
- CVE-2023-30577AMANDA (Advanced Maryland Automatic Network Disk Archiver) b…7.8
- CVE-2023-3058A vulnerability was found in 07FLY CRM up to 1.2.0. It has b…5.4
- CVE-2023-30581The use of __proto__ in process.mainModule.__proto__.require…7.5
- CVE-2023-30582A vulnerability has been identified in Node.js version 20, a…5.3
- CVE-2023-30583fs.openAsBlob() can bypass the experimental permission model…7.5
Are you affected by CVE-2023-30575?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST