CVE-2022-24883
Assigner: GitHub_M
Published: 2022-04-26T00:00:00
State: PUBLISHED
title: FreeRDP Server authentication might allow invalid credentials to pass
descriptions: value: FreeRDP is a free implementation of the Remote Desktop Protocol (RDP). Prior to version 2.7.0, server side authentication against a `SAM` file might be successful for invalid credentials if the server has configured an invalid `SAM` file path. FreeRDP based clients are not affected. RDP server implementations using FreeRDP to authenticate against a `SAM` file are affected. Version 2.7.0 contains a fix for this issue. As a workaround, use custom authentication via `HashCallback` and/or ensure the `SAM` database path configured is valid and the application has file handles left.
affected: vendor: FreeRDP
product: FreeRDP
versions: version: < 2.7.0
status: affected
metrics: cvssV3_1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: NONE
baseScore: 7.4
baseSeverity: HIGH
problemTypes: descriptions: type: CWE
description: CWE-287: Improper Authentication
cweId: CWE-287
source: advisory: GHSA-qxm3-v2r6-vmwf
discovery: UNKNOWN