cve.bz

CVE-2018-1340

7.5 highEPSS 2.0%

High (7.5) in apache guacamole. EPSS 2.0% chance of exploitation in the next 30 days. Fixed in org.apache.guacamole:guacamole-common 1.0.0.

Prior to 1.0.0, Apache Guacamole used a cookie for client-side storage of the user's session token. This cookie lacked the "secure" flag, which could allow an attacker eavesdropping on the network to intercept the user's session token if unencrypted HTTP requests are made to the same domain.

Severity

CVSS 3.0

7.5 high
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS
2.0% chance of exploitation in the next 30 days; higher than 81% of CVEs (scores of 2026-10-31)
CWE
CWE-311
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-wr7r-vg3c-54r5Mavenorg.apache.guacamole:guacamole-common<1.0.01.0.0

References

Check your stackJSON