Document vulnerability CVE-2018-1340, fixed in 1.0.0.

_security/CVE-2018-1340.md

@@ -0,0 +1,13 @@
+---
+title: Secure flag missing from session cookie
+cve:   CVE-2018-1340
+fixed: 1.0.0
+---
+
+Prior to 1.0.0, Apache Guacamole used a cookie for client-side storage of the
+user's session token. This cookie lacked the "secure" flag, which could allow
+an attacker eavesdropping on the network to intercept the user's session token
+if unencrypted HTTP requests are made to the same domain.
+
+Acknowledgements: We would like to thank Ross Golder for reporting this issue.
+