CVE-2021-43999

{"id": "CVE-2021-43999", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:P", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 6.8, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2022-01-11T22:15:07.627", "references": [{"url": "http://www.openwall.com/lists/oss-security/2022/01/11/7", "tags": ["Mailing List", "Third Party Advisory"], "source": "security@apache.org"}, {"url": "https://lists.apache.org/thread/4dt9h5mo4o9rxlgxm3rp8wfqdtdjn2z9", "tags": ["Mailing List", "Vendor Advisory"], "source": "security@apache.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-287"}]}, {"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-287"}]}], "descriptions": [{"lang": "en", "value": "Apache Guacamole 1.2.0 and 1.3.0 do not properly validate responses received from a SAML identity provider. If SAML support is enabled, this may allow a malicious user to assume the identity of another Guacamole user."}, {"lang": "es", "value": "Apache Guacamole versiones 1.2.0 y 1.3.0, no comprueban correctamente las respuestas recibidas de un proveedor de identidad SAML. Si la compatibilidad con SAML est\u00e1 habilitada, esto puede permitir que un usuario malicioso asuma la identidad de otro usuario de Guacamole"}], "lastModified": "2022-01-14T16:16:49.483", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:guacamole:1.2.0:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "19C6CFCC-0796-4201-BEF4-78A6E5A11C85"}, {"criteria": "cpe:2.3:a:apache:guacamole:1.3.0:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2526DE35-521D-4709-A0E8-022B430F1AF5"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}