CVE-2020-9497

Exploitation

Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.

SSVC decision

Not assessed by CISA

EPSS probability

0.80% probability of exploitation activity in the next 30 days.

EPSS percentile

Ranks above 53.8% of scored records. A rank, not a probability.

NVD base score

4.4 (CVSS v3.x), scored by the NVD independently of the CNA.

NVD CVSS vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N

NVD analysis status

Modified. NVD last modified this record on 2026-06-17.

Red Hat severity

No Red Hat rating. Red Hat rates the CVEs that affect its products.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

Published

2020-07-02 12:30Z6 YR AGO

Last updated

2024-08-04 10:34Z2 YR AGO

Reserved

2020-03-01

Assigning CNA

apache

Record state

PUBLISHED

Severity

Not rated by the issuing CNA

CNA CVSS vector

Not published by the issuing CNA

Weaknesses

• CWE-20Improper Input ValidationClass

Data version

5.1

Document digest

8b44058a752b01c874863fae093f7da5834160c61d41a941ed2899da7520029a

• lists.apache.orghttps://lists.apache.org/thread.html/r65f75d3d65d1af68141f42071ebb27dda24af3e45570e593c1dbd81f%40%3Cannounce.guacamole.apache.org%3Ex_refsource_MISC
• lists.apache.org[announce] 20200701 [SECURITY] CVE-2020-9497: Apache Guacamole: Improper input validation of RDP static virtual channelshttps://lists.apache.org/thread.html/r3f071de70ea1facd3601e0fa894e6cadc960627ee7199437b5a56f7f%40%3Cannounce.apache.org%3Emailing-listx_refsource_MLIST
• lists.apache.org[guacamole-user] 20200703 Re: [SECURITY] CVE-2020-9497: Apache Guacamole: Improper input validation of RDP static virtual channelshttps://lists.apache.org/thread.html/r066543f0565e97b27c0dfe27e93e8a387b99e1e35764000224ed96e7%40%3Cuser.guacamole.apache.org%3Emailing-listx_refsource_MLIST
• lists.apache.org[guacamole-user] 20200703 RE: [SECURITY] CVE-2020-9497: Apache Guacamole: Improper input validation of RDP static virtual channelshttps://lists.apache.org/thread.html/r181b1d5b1acb31cfa69f41b2c86ed3a2cb0b5bc09c2cbd31e9e7c847%40%3Cuser.guacamole.apache.org%3Emailing-listx_refsource_MLIST
• research.checkpoint.comhttps://research.checkpoint.com/2020/apache-guacamole-rce/x_refsource_MISC
• kb.pulsesecure.nethttps://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44525x_refsource_CONFIRM
• lists.debian.org[debian-lts-announce] 20201106 [SECURITY] [DLA 2435-1] guacamole-server security updatehttps://lists.debian.org/debian-lts-announce/2020/11/msg00010.htmlmailing-listx_refsource_MLIST
• lists.fedoraproject.orgFEDORA-2020-bfde0ab889https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TVV5K2X4EXSAVUUL7IJ3MUJ3ADWMVSBM/vendor-advisoryx_refsource_FEDORA
• lists.fedoraproject.orgFEDORA-2020-640645e518https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WNS7UHBOFV6JHWH5XOEZTE3BREGRSSQ3/vendor-advisoryx_refsource_FEDORA
• lists.apache.org[announce] 20210125 Apache Software Foundation Security Report: 2020https://lists.apache.org/thread.html/r90890afea72a9571d666820b2fe5942a0a5f86be406fa31da3dd0922%40%3Cannounce.apache.org%3Emailing-listx_refsource_MLIST
• lists.apache.org[announce] 20210223 Re: Apache Software Foundation Security Report: 2020https://lists.apache.org/thread.html/r1125f3044a0946d1e7e6f125a6170b58d413ebd4a95157e4608041c7%40%3Cannounce.apache.org%3Emailing-listx_refsource_MLIST