VDB
DEBIAN-CVE-2022-24883
DEBIAN-CVE-2022-24883
PUBLISHED
CVSS 9.800000190734863 CRITICAL
FreeRDP is a free implementation of the Remote Desktop Protocol (RDP). Prior to version 2.7.0, server side authentication against a `SAM` file might be successful for invalid credentials if the server has configured an invalid `SAM` file path. FreeRDP based clients are not affected. RDP server implementations using FreeRDP to authenticate against a `SAM` file are affected. Version 2.7.0 contains a fix for this issue. As a workaround, use custom authentication via `HashCallback` and/or ensure the `SAM` database path configured is valid and the application has file handles left.
Risk Scores
CVSS v3.1
9.800000190734863
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Debian:11 | freerdp2 | 2.3.0+dfsg1-2+deb11u1, *, 0 |
| Debian:12 | freerdp2 | 0, 0, 0 |
Timeline
- Apr 26, 2022 CVE Published
- Apr 28, 2026 CVE Updated