{"id":"CVE-2021-43999","details":"Apache Guacamole 1.2.0 and 1.3.0 do not properly validate responses received from a SAML identity provider. If SAML support is enabled, this may allow a malicious user to assume the identity of another Guacamole user.","aliases":["BIT-guacamole-2021-43999","BIT-guacamole-server-2021-43999"],"modified":"2026-07-08T23:58:14.972755Z","published":"2022-01-11T22:15:07.627Z","references":[{"type":"ADVISORY","url":"http://www.openwall.com/lists/oss-security/2022/01/11/7"},{"type":"ADVISORY","url":"https://lists.apache.org/thread/4dt9h5mo4o9rxlgxm3rp8wfqdtdjn2z9"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/apache/guacamole-server","events":[{"introduced":"6042222d44d3b501defaff3d51be442fae710f06"},{"last_affected":"90e15cb70635e8d13ebdefec9262701d2179983a"}],"database_specific":{"cpe":["cpe:2.3:a:apache:guacamole:1.2.0:-:*:*:*:*:*:*","cpe:2.3:a:apache:guacamole:1.3.0:-:*:*:*:*:*:*"],"extracted_events":[{"introduced":"1.2.0-NA"},{"last_affected":"1.2.0-NA"},{"introduced":"1.3.0-NA"},{"last_affected":"1.3.0-NA"}],"source":"CPE_STRING"}}],"versions":["1.2.0-NA","1.3.0-NA"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-43999.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}