CVE-2022-23613

Katalog CVE

CVSS 7.8 · High EPSS 0,49%

Kerentanan Integer Underflow (Wrap or Wraparound) pada neutrinolabs xrdp, fedoraproject fedora. Skor CVSS 3.1 7.8 (High) menurut NVD.

Deskripsi (NVD)

xrdp is an open source remote desktop protocol (RDP) server. In affected versions an integer underflow leading to a heap overflow in the sesman server allows any unauthenticated attacker which is able to locally access a sesman server to execute code as root. This vulnerability has been patched in version 0.9.18.1 and above. Users are advised to upgrade. There are no known workarounds.

Rincian

Terbit di NVD

7 Februari 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-191: Integer Underflow (Wrap or Wraparound)

EPSS (30 hari)

0,49% peluang dieksploitasi; lebih tinggi dari 40,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/neutrinolabs/xrdp/commit/4def30ab8ea445cdc06832a44c3ec40a506a0ffa patch · advisory pihak ketiga
• https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-8h98-h426-xf32 advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K5ONRGARKHGFU...
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U3XGFJNQMNXHB...