{"id":"BIT-guacamole-server-2021-43999","details":"Apache Guacamole 1.2.0 and 1.3.0 do not properly validate responses received from a SAML identity provider. If SAML support is enabled, this may allow a malicious user to assume the identity of another Guacamole user.","aliases":["BIT-guacamole-2021-43999","CVE-2021-43999"],"modified":"2024-03-06T11:25:28.861Z","published":"2024-03-06T10:53:22.980Z","database_specific":{"severity":"High","cpes":["cpe:2.3:a:apache:guacamole:1.2.0:-:*:*:*:*:*:*","cpe:2.3:a:apache:guacamole:1.3.0:-:*:*:*:*:*:*"]},"references":[{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2022/01/11/7"},{"type":"WEB","url":"https://lists.apache.org/thread/4dt9h5mo4o9rxlgxm3rp8wfqdtdjn2z9"}],"affected":[{"package":{"name":"guacamole-server","ecosystem":"Bitnami","purl":"pkg:bitnami/guacamole-server"},"ranges":[{"type":"SEMVER","events":[{"introduced":"1.2.0"},{"last_affected":"1.2.0"},{"introduced":"1.3.0"},{"last_affected":"1.3.0"}]}],"database_specific":{"source":"https://github.com/bitnami/vulndb/tree/main/data/guacamole-server/BIT-guacamole-server-2021-43999.json"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}],"schema_version":"1.7.3"}