CVE-2022-24882

Katalog CVE

CVSS 7.5 · High EPSS 2,8%

Kerentanan Improper Authentication pada freerdp, fedoraproject extra packages for enterprise linux +1 lainnya. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP). In versions prior to 2.7.0, NT LAN Manager (NTLM) authentication does not properly abort when someone provides and empty password value. This issue affects FreeRDP based RDP Server implementations. RDP clients are not affected. The vulnerability is patched in FreeRDP 2.7.0. There are currently no known workarounds.

Rincian

Terbit di NVD

26 April 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-287: Improper Authentication

EPSS (30 hari)

2,8% peluang dieksploitasi; lebih tinggi dari 86,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/FreeRDP/FreeRDP/pull/7750 patch · advisory pihak ketiga
• https://github.com/FreeRDP/FreeRDP/releases/tag/2.7.0 release notes · advisory pihak ketiga
• https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-6x5p-gp49-3jhh advisory pihak ketiga
• https://gitlab.gnome.org/GNOME/gnome-remote-desktop/-/issues/95 exploit · issue tracking · advisory pihak ketiga
• https://security.gentoo.org/glsa/202210-24 advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AELSWWBAM2YON...
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DOYKBQOHSRM7J...
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PZWR6KSIKXO4B...
• https://lists.debian.org/debian-lts-announce/2025/02/msg00034.html