CVE-2022-24883
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2022-24883
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-24883.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2022-24883
- Aliases
-
- GHSA-qxm3-v2r6-vmwf
- Downstream
- Related
- Published
- 2022-04-26T00:00:00Z
- Modified
- 2025-10-14T19:13:39.135870Z
- Severity
-
- 7.4 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N CVSS Calculator
- Summary
- FreeRDP Server authentication might allow invalid credentials to pass
- Details
-
FreeRDP is a free implementation of the Remote Desktop Protocol (RDP). Prior to version 2.7.0, server side authentication against a
SAMfile might be successful for invalid credentials if the server has configured an invalidSAMfile path. FreeRDP based clients are not affected. RDP server implementations using FreeRDP to authenticate against aSAMfile are affected. Version 2.7.0 contains a fix for this issue. As a workaround, use custom authentication viaHashCallbackand/or ensure theSAMdatabase path configured is valid and the application has file handles left. - References
-
- https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-qxm3-v2r6-vmwf
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AELSWWBAM2YONRPGLWVDY6UNTLJERJYL/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DOYKBQOHSRM7JQYUIYUWFOXI2JZ2J5RD/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PZWR6KSIKXO4B2TXBB3WH6YTNYHN46OY/
- https://security.gentoo.org/glsa/202210-24
- https://lists.debian.org/debian-lts-announce/2023/11/msg00010.html
- https://github.com/FreeRDP/FreeRDP/commit/4661492e5a617199457c8074bad22f766a116cdc
- https://github.com/FreeRDP/FreeRDP/commit/6f473b273a4b6f0cb6aca32b95e22fd0de88e144
- https://github.com/FreeRDP/FreeRDP/releases/tag/2.7.0
Affected packages
Git / github.com/FreeRDP/FreeRDP
Affected ranges
- Type
- GIT
- Repo
- https://github.com/FreeRDP/FreeRDP
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixed
Affected versions
1.*
1.0-beta1
1.0-beta2
1.0-beta3
1.0-beta4
1.0-beta5
1.0.0
1.0.1
1.1.0-beta+2013071101
1.1.0-beta1
1.1.0-beta1+android2
1.1.0-beta1+android3
1.1.0-beta1+android4
1.1.0-beta1+android5
1.1.0-beta1+ios1
1.1.0-beta1+ios2
1.1.0-beta1+ios3
1.1.0-beta1+ios4
1.2.0-beta1+android7
1.2.0-beta1+android9
2.*
2.0.0
2.0.0-beta1+android10
2.0.0-beta1+android11
2.0.0-rc0
2.0.0-rc1
2.0.0-rc2
2.0.0-rc3
2.0.0-rc4
2.1.0
2.1.1
2.1.2
2.2.0
2.3.0
2.3.1
2.3.2
2.4.1
2.5.0
2.6.0
2.6.1