PT-2022-5522 · Freerdp+6 · Freerdp+6

Akallabeth · Published 2022-04-22 · Updated 2025-02-15 · CVE-2022-24883

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 2.7.0

Description The issue is related to the authentication procedure in FreeRDP, a free implementation of the Remote Desktop Protocol (RDP). Server-side authentication against a SAM file might be successful for invalid credentials if the server has configured an invalid SAM file path. This affects RDP server implementations using FreeRDP to authenticate against a SAM file, but FreeRDP-based clients are not affected.

Recommendations For versions prior to 2.7.0, update to version 2.7.0 to resolve the issue. As a temporary workaround, consider using custom authentication via HashCallback and/or ensure the SAM database path configured is valid and the application has file handles left.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

ALT-PU-2022-1764

ALT-PU-2022-1774

ALT-PU-2022-2881

ALT-PU-2022-3288

BDU:2022-06851

CVE-2022-24883

DLA-3654-1

DLA-4053-1

GHSA-QXM3-V2R6-VMWF

MGASA-2022-0383

OESA-2022-1657

OPENSUSE-SU-2022_2353-1

OPENSUSE-SU-2022_2354-1

OPENSUSE-SU-2024:13504-1

SUSE-SU-2022:2352-1

SUSE-SU-2022:2353-1

SUSE-SU-2022:2354-1

USN-5461-1

Affected Products

Alt Linux

Astra Linux

Freerdp

Linuxmint

Red Os

Suse

Ubuntu

References · 72

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24883.json · Exploit
• https://github.com/FreeRDP/FreeRDP/commit/4661492e5a617199457c8074bad22f766a116cdc · Patch
• https://github.com/FreeRDP/FreeRDP/commit/6f473b273a4b6f0cb6aca32b95e22fd0de88e144 · Patch
• https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-qxm3-v2r6-vmwf · Patch
• https://advisories.mageia.org/MGASA-2022-0383.html · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AELSWWBAM2YONRPGLWVDY6UNTLJERJYL · Vendor Advisory
• https://ubuntu.com/security/notices/USN-5461-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-24883 · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/PZWR6KSIKXO4B2TXBB3WH6YTNYHN46OY · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2022-1121SE47 · Vendor Advisory
• https://osv.dev/vulnerability/USN-5461-1 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2022-1110SE17 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-24883 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/AELSWWBAM2YONRPGLWVDY6UNTLJERJYL · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-24883 · Security Note