title: Private tunnel identifier may be included in the non-private details of active connections
description: Apache Guacamole 1.3.0 and older may incorrectly include a private tunnel identifier in the non-private details of some REST responses. This may allow an authenticated user who already has permission to access a particular connection to read from or interact with another user's active use of that same connection.
problem types: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
affected:
{
product: Apache Guacamole
vendor: Apache Software Foundation
versions:
lessThanOrEqual: 1.3.0, status: affected, version: unspecified, versionType: custom
}
metrics:
other: [
content: {'other': 'moderate'}
type: unknown
]