CVE-2023-30575: Apache Guacamole 1.5.1 and older may incorrectly calculate the lengths of instruction elements sent during the Guacamole protocol handshake, potentially…

PriorityP344high7.5CVSS 3.1

AVNACLPRNUINSUCNIHAN

EPSS

1.15%

63.2th percentile

Apache Guacamole 1.5.1 and older may incorrectly calculate the lengths of instruction elements sent during the Guacamole protocol handshake, potentially allowing an attacker to inject Guacamole instructions during the handshake through specially-crafted data.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
apache	guacamole	< 1.5.2	1.5.2
apache	guacamole	—	—
apache_software_foundation	apache_guacamole	<= 1.5.1	—

CVSS provenance

nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

osv7.5HIGH

vendor_apache6.5MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.