CVE-2020-11997: Inconsistent restriction of connection history visibility

Severity:	Medium
CVSS v3.1 base score:	4.1
CVSS v3.1 vector:	AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:H/RL:O/RC:C

Software affected

• Glyptodon Enterprise 1.13 and older

• Glyptodon Enterprise 2.1 and older

Description

Apache Guacamole 1.2.0 and older do not consistently restrict access to connection history based on user visibility. If multiple users share access to the same connection, those users may be able to see which other users have accessed that connection, as well as the IP addresses from which that connection was accessed, even if those users do not otherwise have permission to see other users.

Preconditions for exploitation

• Multiple users that share access to the same connections.

Results of a successful attack

• A user with access to a connection is able to see whether other users have accessed that connection, as well as the IP addresses used to access the connection.

Mitigation

Both Glyptodon Enterprise 1.x and 2.x have been patched with respect to this vulnerability. Users should evaluate their exposure/risk based on this advisory and plan to upgrade when possible.

Analysis and CVSS score breakdown

Metric	Value	Comments
Attack Vector	Network	Exploiting this vulnerability relies only on communicating with the web application through standard mechanisms, as already exposed by Guacamole's web interface.
Attack Complexity	Low	Exploiting this vulnerability requires limited technical ability, as the information in question is retrieved through standard mechanisms already exposed by Guacamole's web interface.
Privileges Required	Low	Obtaining the information in question requires a user account with access to one or more connections. Information on connection usage can be retrieved only for connections accessible by the user.
User Interaction	None	An attacker would require no additional user interaction beyond their own.
Scope	Unchanged	The scope of information obtained does not extend beyond what Guacamole is explicitly designed to provide.
Confidentiality Impact	Low	Retrievable information is limited to the usernames of users that have accessed connections that the current user may also access, as well as the IP addresses used for those past accesses.
Integrity	None	Data integrity is in no way affected. The relevant information may be read, not modified.
Availability	None	The availability of Guacamole and all related services are unaffected.
Exploitability	High	Exploiting this vulnerability requires limited technical ability, as the information in question is retrieved through standard mechanisms already exposed by Guacamole's web interface.
Remediation Level	Official fix available	The upstream Apache Guacamole project has released a fix via their 1.3.0 release, and this fix has been backported to all affected versions of Glyptodon Enterprise.
Report Confidence	Confirmed	Existence of the vulnerability in Apache Guacamole 1.2.0 and older has been acknowledged by the upstream Apache Guacamole project.