CVE-2022-39347

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2022-39347
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-39347.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2022-39347
Aliases
  • GHSA-c5xq-8v35-pffg
Downstream
Related
Published
2022-11-16T00:00:00Z
Modified
2026-07-22T02:08:03.660709Z
Severity
  • 2.6 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N CVSS Calculator
Summary
Missing path sanitation with `drive` channel in FreeRDP
Details

FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP are missing path canonicalization and base path check for drive channel. A malicious server can trick a FreeRDP based client to read files outside the shared directory. This issue has been addressed in version 2.9.0 and all users are advised to upgrade. Users unable to upgrade should not use the /drive, /drives or +home-drive redirection switch.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39347.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-22"
    ]
}
References

Affected packages

Git / github.com/freerdp/freerdp

Affected ranges

Type
GIT
Repo
https://github.com/freerdp/freerdp
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
fa8e1b1c765a4466030ac52240f052c0b440a4d1
Fixed
027424c2c6c0991cb9c22f9511478229c9b17e5d
Database specific 
{
    "cpe": "cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.9.0"
        }
    ],
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

1.*
1.0-beta1
1.0-beta2
1.0-beta4
1.0-beta5
1.0.0
1.0.1
1.1.0-beta+2013071101
1.1.0-beta1
1.1.0-beta1+android2
1.1.0-beta1+android3
1.1.0-beta1+android4
1.1.0-beta1+android5
1.1.0-beta1+ios1
1.1.0-beta1+ios2
1.1.0-beta1+ios3
1.1.0-beta1+ios4
1.2.0-beta1+android7
1.2.0-beta1+android9
2.*
2.0.0
2.0.0-beta1+android10
2.0.0-beta1+android11
2.0.0-rc0
2.0.0-rc1
2.0.0-rc2
2.0.0-rc3
2.0.0-rc4
2.1.0
2.1.1
2.1.2
2.2.0
2.3.0
2.3.1
2.3.2
2.4.1
2.5.0
2.6.0
2.6.1
2.7.0
2.8.0
2.8.1

Database specific

vanir_signatures 
[
    {
        "digest": {
            "line_hashes": [
                "290591328942394821619176785848561268410",
                "335406687288143362762442667856828215649",
                "20519757147941846060567017784870984854",
                "229972281375681814445391784799988295429",
                "140749441333289697312946167814323960243",
                "190308491853018271083008128430940233846",
                "233838662661606121033355431086464318248",
                "145098627091867605178255376497829386340",
                "76448358934214355866670668815517047123",
                "176991272943609779726655330632101995046"
            ],
            "threshold": 0.9
        },
        "signature_type": "Line",
        "deprecated": false,
        "id": "CVE-2022-39347-3508b184",
        "target": {
            "file": "channels/drive/client/drive_main.c"
        },
        "source": "https://github.com/freerdp/freerdp/commit/027424c2c6c0991cb9c22f9511478229c9b17e5d",
        "signature_version": "v1"
    },
    {
        "digest": {
            "function_hash": "260952216101100896571612303714273406875",
            "length": 473.0
        },
        "signature_type": "Function",
        "deprecated": false,
        "id": "CVE-2022-39347-390224e9",
        "target": {
            "file": "channels/drive/client/drive_file.c",
            "function": "drive_file_combine_fullpath"
        },
        "source": "https://github.com/freerdp/freerdp/commit/027424c2c6c0991cb9c22f9511478229c9b17e5d",
        "signature_version": "v1"
    },
    {
        "digest": {
            "line_hashes": [
                "248553239335900325584985289247176288716",
                "135878278048545551566787446066942222975",
                "172620551596641331948330102805732093158",
                "295425609185696648157631465253483552010",
                "221383497882808530476471175391678400317",
                "254317494590996612115867831136584923116",
                "238735998323664406757986581235841707939",
                "263527676561790304475541892763209934160",
                "91112401587650353128882219337340322382",
                "176964976740551186718815375593605223925",
                "299013501032045782459172379336665560152",
                "306517712545606911363178016660788672160",
                "25343794043994341743336467643709781280",
                "266027263182689156065952150047698167934",
                "132049146076183447371189191955632865845",
                "213169873153768706863367101394587424803",
                "91551370229648943735730759740791499582",
                "189099272955315653813835860922073462517",
                "197971798508174200408308734764115696061",
                "100118585381496216313445735170734986397",
                "186773629910537752876184955179518357991",
                "155166266405092132195045250486454029525",
                "239700266876474759311878725045063559972",
                "268766385012771439970062345546858218609",
                "175256353515058124457488147637521995026",
                "331948336464000134154078014774151712632",
                "93197270941532769303713781290470510568",
                "311686831208996926794012716428961015846",
                "243975057745125963175279566168304283557",
                "300382968748650816169147881297891167910",
                "319160185026761803757329949586413605099",
                "78190912635033918908994274708933004968",
                "61494029176309532305322085274840059670",
                "266040420684510491325306679388149054519",
                "6567488724521620197671488945777052874",
                "46929630654712137694530974838879745597",
                "259591874064448054096037883104655247739",
                "161391879775698111432148170382011096558",
                "176243534394555782634559055334850965855",
                "317593280284314763805123358625838343045",
                "279279150360429849387881363606545527804",
                "273879949949396719008903306245644600309",
                "121204031919672000931190203736095522178",
                "192491476919648809011070738452622796734",
                "218388636401376795867216074486296129093",
                "113854674659146396263886920465338187594",
                "65035649048143300817322523019449389111",
                "65430323170042994621023208588148545871",
                "23915142942408653610202811291622571446",
                "288764499136229373300548631669629507487",
                "245384090310431392522913793723813156261",
                "59556694233017307990736952932821628496",
                "134557425674643250413495831428070120819",
                "315756958536373758929089354364954650074",
                "177116783596327202560342777165785016662",
                "289430643373693815951420401843210715792",
                "173869059712170358061485805502118274280",
                "19397340730597852473308895637558998115",
                "186430052832808390098851055813847777117",
                "308149034795781231556178808713401390134",
                "332224044163609177248291264037363465730",
                "82686224434858307524972996435364143355",
                "248382609252166450697119703981488141970",
                "241025741252792625174358725144482963412",
                "257809229915169453538946618425746688519",
                "71931066835543294576121017612616331016",
                "40705453148024616383076843360999041841",
                "226247864100701000061367158484563948438",
                "162699948461877850696868147397836642617",
                "147551768246211167971635961816345235588",
                "118946247848326709538424218563247718363",
                "184051266245511055840359691878850903589",
                "314587923817559469016796073220590359113",
                "181231047586802876657803920976726764079",
                "72774197824611249642252770787715273270",
                "154471152255016975646052331054914490077",
                "152259281539908125707006612375846709949",
                "220715322427924304083543280978416588444",
                "307294325166581388755195954986760290709",
                "128258109548279524457942213068370053492",
                "28196237252488805870035169806523481544",
                "221701928761195426375258303037461556081",
                "13894025492365548226743864539252817196",
                "315608466339390195743846133040187849480",
                "302661308763062461000336958030943294749",
                "60887097567097397691673400878172617221",
                "41624692126751203286259804952514945410",
                "213887536283202875159733887323741877741",
                "234036708142946729045448540181453443123",
                "231141018540379579968556768871493390042",
                "98197901034005382906628345939175522453",
                "105069653898801318212634578137125337791",
                "293966427902171113129649186575483337779",
                "263948757973881768749334840785327655987",
                "321555479646930445071305262215274213968",
                "137349947884731218518483985036383940491",
                "27746345551637029114359567552861759204"
            ],
            "threshold": 0.9
        },
        "signature_type": "Line",
        "deprecated": false,
        "id": "CVE-2022-39347-448a8724",
        "target": {
            "file": "channels/drive/client/drive_file.c"
        },
        "source": "https://github.com/freerdp/freerdp/commit/027424c2c6c0991cb9c22f9511478229c9b17e5d",
        "signature_version": "v1"
    },
    {
        "digest": {
            "line_hashes": [
                "72948886230247326096666785655918579858",
                "29333083308896062814581375091197699878",
                "30909489476707713747924496511064340021",
                "265889586962900380121165192111511246271",
                "141173924152054176952941177348977304297",
                "35144359828024183922527558511163564686",
                "165791126707946461535592763500382707748",
                "238962438083969342402474376136096362375"
            ],
            "threshold": 0.9
        },
        "signature_type": "Line",
        "deprecated": false,
        "id": "CVE-2022-39347-45201795",
        "target": {
            "file": "channels/drive/client/drive_file.h"
        },
        "source": "https://github.com/freerdp/freerdp/commit/027424c2c6c0991cb9c22f9511478229c9b17e5d",
        "signature_version": "v1"
    },
    {
        "digest": {
            "function_hash": "240481646969107594940048899026392203014",
            "length": 3685.0
        },
        "signature_type": "Function",
        "deprecated": false,
        "id": "CVE-2022-39347-b313b2ca",
        "target": {
            "file": "channels/drive/client/drive_file.c",
            "function": "drive_file_set_information"
        },
        "source": "https://github.com/freerdp/freerdp/commit/027424c2c6c0991cb9c22f9511478229c9b17e5d",
        "signature_version": "v1"
    },
    {
        "digest": {
            "function_hash": "22588013693904811326232017491640203341",
            "length": 1194.0
        },
        "signature_type": "Function",
        "deprecated": false,
        "id": "CVE-2022-39347-bab26d34",
        "target": {
            "file": "channels/drive/client/drive_file.c",
            "function": "drive_file_remove_dir"
        },
        "source": "https://github.com/freerdp/freerdp/commit/027424c2c6c0991cb9c22f9511478229c9b17e5d",
        "signature_version": "v1"
    },
    {
        "digest": {
            "function_hash": "312948699714045788384632950966874520297",
            "length": 1529.0
        },
        "signature_type": "Function",
        "deprecated": false,
        "id": "CVE-2022-39347-c0726788",
        "target": {
            "file": "channels/drive/client/drive_main.c",
            "function": "drive_process_irp_create"
        },
        "source": "https://github.com/freerdp/freerdp/commit/027424c2c6c0991cb9c22f9511478229c9b17e5d",
        "signature_version": "v1"
    },
    {
        "digest": {
            "function_hash": "145655026188127974666537535230233011320",
            "length": 437.0
        },
        "signature_type": "Function",
        "deprecated": false,
        "id": "CVE-2022-39347-e2e1eaca",
        "target": {
            "file": "channels/drive/client/drive_file.c",
            "function": "drive_file_fix_path"
        },
        "source": "https://github.com/freerdp/freerdp/commit/027424c2c6c0991cb9c22f9511478229c9b17e5d",
        "signature_version": "v1"
    },
    {
        "digest": {
            "function_hash": "173094841742670436169063300056138337321",
            "length": 854.0
        },
        "signature_type": "Function",
        "deprecated": false,
        "id": "CVE-2022-39347-eff9c255",
        "target": {
            "file": "channels/drive/client/drive_main.c",
            "function": "drive_process_irp_query_directory"
        },
        "source": "https://github.com/freerdp/freerdp/commit/027424c2c6c0991cb9c22f9511478229c9b17e5d",
        "signature_version": "v1"
    }
]
vanir_signatures_modified 
"2026-07-22T02:08:03Z"
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-39347.json"