Skip to main content

Guacamole CVE-2023-30575

HIGH
Incorrect Calculation of Buffer Size (CWE-131)
2023-06-07 security@apache.org
Apache Code Injection Guacamole
7.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None

Lifecycle Timeline

1
CVE Published
Jun 07, 2023 - 09:15 nvd
HIGH 7.5

DescriptionNVD

Apache Guacamole 1.5.1 and older may incorrectly calculate the lengths of instruction elements sent during the Guacamole protocol handshake, potentially allowing an attacker to inject Guacamole instructions during the handshake through specially-crafted data.

AnalysisAI

Apache Guacamole 1.5.1 and older may incorrectly calculate the lengths of instruction elements sent during the Guacamole protocol handshake, potentially allowing an attacker to inject Guacamole. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-131. Apache Guacamole 1.5.1 and older may incorrectly calculate the lengths of instruction elements sent during the Guacamole protocol handshake, potentially allowing an attacker to inject Guacamole instructions during the handshake through specially-crafted data. Affected products include: Apache Guacamole.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Guacamole

View all
CVE-2012-4415 HIGH POC
7.5 Oct 01

Stack-based buffer overflow in the guac_client_plugin_open function in libguac in Guacamole before 0.6.3 allows remote a
CVE-2023-43826 HIGH
8.8 Dec 19

Apache Guacamole 1.5.3 and older do not consistently ensure that values received from a VNC server will not result in in
CVE-2023-30576 HIGH
8.1 Jun 07

Apache Guacamole 0.9.10 through 1.5.1 may continue to reference a freed RDP audio input buffer. Rated high severity (CVS
CVE-2019-19603 HIGH
7.5 Dec 09

SQLite 3.30.1 mishandles certain SELECT statements with a nonexistent VIEW, leading to an application crash. Rated high

CVE-2024-35164 MEDIUM
6.8 Jul 02

The terminal emulator of Apache Guacamole 1.5.5 and older does not properly validate console codes received from servers
CVE-2020-9498 MEDIUM
6.7 Jul 02

Apache Guacamole 1.1.0 and older may mishandle pointers involved inprocessing data received via RDP static virtual chann
CVE-2016-1566 MEDIUM
5.4 Feb 02

Cross-site scripting (XSS) vulnerability in the file browser in Guacamole 0.9.8 and 0.9.9, when file transfer is enabled
CVE-2020-9497 MEDIUM
4.4 Jul 02

Apache Guacamole 1.1.0 and older do not properly validate datareceived from RDP servers via static virtual channels. Rat

Same weakness CWE-131 – Incorrect Calculation of Buffer Size

View all
CVE-2024-23606 CRITICAL POC
9.8
CVE-2021-21824 CRITICAL POC
9.8
CVE-2025-66216 CRITICAL POC
9.3
CVE-2021-21793 HIGH POC
8.8
CVE-2021-21782 HIGH POC
8.8
CVE-2021-21776 HIGH POC
8.8
CVE-2023-0568 HIGH POC
8.1
CVE-2021-29608 HIGH POC
7.8

Same technique Code Injection

View all
CVE-2012-0158 HIGH POC
8.8
CVE-2014-6287 CRITICAL POC
9.8
CVE-2017-7494 CRITICAL POC
9.8
CVE-2025-24893 CRITICAL POC
9.8
CVE-2025-47812 CRITICAL POC
10.0
CVE-2013-3906 HIGH POC
7.8
CVE-2017-9822 HIGH POC
8.8
CVE-2018-1273 CRITICAL POC
9.8

Share

CVE-2023-30575 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy