ByteOS Network

NVD Vulnerability Details :

CVE-2022-24883

Modified

Source-security-advisories@github.com

Published At-26 Apr, 2022 | 16:15

Updated At-17 Nov, 2023 | 19:15

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP). Prior to version 2.7.0, server side authentication against a `SAM` file might be successful for invalid credentials if the server has configured an invalid `SAM` file path. FreeRDP based clients are not affected. RDP server implementations using FreeRDP to authenticate against a `SAM` file are affected. Version 2.7.0 contains a fix for this issue. As a workaround, use custom authentication via `HashCallback` and/or ensure the `SAM` database path configured is valid and the application has file handles left.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Secondary	3.1	7.4	HIGH	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Primary	2.0	6.8	MEDIUM	AV:N/AC:M/Au:N/C:P/I:P/A:P

CPE Matches

FreeRDP

>>freerdp>>Versions before 2.7.0(exclusive)

cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*

Fedora Project

>>fedora>>34

cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*

Fedora Project

>>fedora>>35

cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*

Fedora Project

>>fedora>>36

cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-287	Primary	nvd@nist.gov
CWE-287	Secondary	security-advisories@github.com

References

Hyperlink	Source	Resource
https://github.com/FreeRDP/FreeRDP/commit/4661492e5a617199457c8074bad22f766a116cdc	security-advisories@github.com	Patch Third Party Advisory
https://github.com/FreeRDP/FreeRDP/commit/6f473b273a4b6f0cb6aca32b95e22fd0de88e144	security-advisories@github.com	Patch Third Party Advisory
https://github.com/FreeRDP/FreeRDP/releases/tag/2.7.0	security-advisories@github.com	Release Notes Third Party Advisory
https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-qxm3-v2r6-vmwf	security-advisories@github.com	Patch Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/11/msg00010.html	security-advisories@github.com	N/A
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AELSWWBAM2YONRPGLWVDY6UNTLJERJYL/	security-advisories@github.com	N/A
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DOYKBQOHSRM7JQYUIYUWFOXI2JZ2J5RD/	security-advisories@github.com	N/A
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PZWR6KSIKXO4B2TXBB3WH6YTNYHN46OY/	security-advisories@github.com	N/A
https://security.gentoo.org/glsa/202210-24	security-advisories@github.com	Third Party Advisory

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History