CVE-2016-1566: XSS
Cross-site scripting (XSS) vulnerability in the file browser in Guacamole 0.9.8 and 0.9.9, when file transfer is enabled to a location shared by multiple users, allows remote authenticated users to inject arbitrary web script or HTML via a crafted filename. NOTE: this vulnerability was fixed in guacamole.war on 2016-01-13, but the version number was not changed.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-1566?
CVE-2016-1566 has a medium severity rating due to its potential for cross-site scripting attacks.
How do I fix CVE-2016-1566?
To fix CVE-2016-1566, update your Apache Guacamole installation to version 0.9.10 or later.
Who is affected by CVE-2016-1566?
Users of Apache Guacamole versions 0.9.8 and 0.9.9 that have file transfer enabled are affected by CVE-2016-1566.
What type of vulnerability is CVE-2016-1566?
CVE-2016-1566 is a cross-site scripting (XSS) vulnerability.
Can remote users exploit CVE-2016-1566?
Yes, remote authenticated users can exploit CVE-2016-1566 by injecting arbitrary web scripts or HTML through crafted filenames.