CVE-2022-24883
FreeRDP Server authentication might allow invalid credentials to pass
- State
- Published
- Severity
- 7.4 High
- Published
- Apr 26, 2022
- Updated
- Nov 3, 2025
- Reserved
- Feb 10, 2022
Description
FreeRDP is a free implementation of the Remote Desktop Protocol (RDP). Prior to version 2.7.0, server side authentication against a `SAM` file might be successful for invalid credentials if the server has configured an invalid `SAM` file path. FreeRDP based clients are not affected. RDP server implementations using FreeRDP to authenticate against a `SAM` file are affected. Version 2.7.0 contains a fix for this issue. As a workaround, use custom authentication via `HashCallback` and/or ensure the `SAM` database path configured is valid and the application has file handles left.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 7.4 High | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N | GitHub_M |
Weaknesses
- CWE-287 Improper Authentication
Affected Products
| Product | Versions |
|---|---|
FreeRDPFreeRDP |
|
References
- https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-qxm3-v2r6-vmwf
- https://github.com/FreeRDP/FreeRDP/commit/4661492e5a617199457c8074bad22f766a116cdc
- https://github.com/FreeRDP/FreeRDP/commit/6f473b273a4b6f0cb6aca32b95e22fd0de88e144
- https://github.com/FreeRDP/FreeRDP/releases/tag/2.7.0
- FEDORA-2022-dc48a89918vendor-advisory
- FEDORA-2022-a3e03a200bvendor-advisory
- FEDORA-2022-b0a47f8060vendor-advisory
- GLSA-202210-24vendor-advisory
- [debian-lts-announce] 20231117 [SECURITY] [DLA 3654-1] freerdp2 security updatemailing-list
- https://lists.debian.org/debian-lts-announce/2025/02/msg00016.html
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.