Document vulnerability CVE-2020-11997, fixed in 1.3.0.

_security/CVE-2020-11997.md

@@ -0,0 +1,16 @@
+---
+title: Inconsistent restriction of connection history visibility
+cve:   CVE-2020-11997
+fixed: 1.3.0
+---
+
+Apache Guacamole 1.2.0 and older do not consistently restrict access to
+connection history based on user visibility. If multiple users share access to
+the same connection, those users may be able to see which other users have
+accessed that connection, as well as the IP addresses from which that
+connection was accessed, even if those users do not otherwise have permission
+to see other users.
+
+Acknowledgements: We would like to thank William Le Berre (Synetis) for
+reporting this issue.
+