CVE-2022-24882
Server side NTLM does not properly check parameters in FreeRDP
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
1Exploited in Wild
-Decision
Descriptions
FreeRDP is a free implementation of the Remote Desktop Protocol (RDP). In versions prior to 2.7.0, NT LAN Manager (NTLM) authentication does not properly abort when someone provides and empty password value. This issue affects FreeRDP based RDP Server implementations. RDP clients are not affected. The vulnerability is patched in FreeRDP 2.7.0. There are currently no known workarounds.
FreeRDP es una implementación libre del protocolo de escritorio remoto (RDP). En las versiones anteriores a 2.7.0, la autenticación NT LAN Manager (NTLM) no aborta correctamente cuando alguien proporciona un valor de contraseña vacío. Este problema afecta a las implementaciones del servidor RDP basadas en FreeRDP. Los clientes RDP no están afectados. La vulnerabilidad está parcheada en FreeRDP versión 2.7.0. Actualmente no se presentan medidas de mitigación conocidas
CVSS Scores
SSVC
- Decision:-
Timeline
- 2022-02-10 CVE Reserved
- 2022-04-26 CVE Published
- 2024-07-18 EPSS Updated
- 2024-08-03 CVE Updated
- 2024-08-03 First Exploit
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-287: Improper Authentication
CAPEC
References (8)
URL | Tag | Source |
---|---|---|
https://github.com/FreeRDP/FreeRDP/releases/tag/2.7.0 | Release Notes | |
https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-6x5p-gp49-3jhh | Third Party Advisory |
URL | Date | SRC |
---|---|---|
https://gitlab.gnome.org/GNOME/gnome-remote-desktop/-/issues/95 | 2024-08-03 |
URL | Date | SRC |
---|---|---|
https://github.com/FreeRDP/FreeRDP/pull/7750 | 2023-11-07 |
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Freerdp Search vendor "Freerdp" | Freerdp Search vendor "Freerdp" for product "Freerdp" | < 2.7.0 Search vendor "Freerdp" for product "Freerdp" and version " < 2.7.0" | - |
Affected
| ||||||
Fedoraproject Search vendor "Fedoraproject" | Extra Packages For Enterprise Linux Search vendor "Fedoraproject" for product "Extra Packages For Enterprise Linux" | 8.0 Search vendor "Fedoraproject" for product "Extra Packages For Enterprise Linux" and version "8.0" | - |
Affected
| ||||||
Fedoraproject Search vendor "Fedoraproject" | Fedora Search vendor "Fedoraproject" for product "Fedora" | 34 Search vendor "Fedoraproject" for product "Fedora" and version "34" | - |
Affected
| ||||||
Fedoraproject Search vendor "Fedoraproject" | Fedora Search vendor "Fedoraproject" for product "Fedora" | 35 Search vendor "Fedoraproject" for product "Fedora" and version "35" | - |
Affected
| ||||||
Fedoraproject Search vendor "Fedoraproject" | Fedora Search vendor "Fedoraproject" for product "Fedora" | 36 Search vendor "Fedoraproject" for product "Fedora" and version "36" | - |
Affected
|