{"id":"CVE-2022-24882","aliases":["DEBIAN-CVE-2022-24882","DLA-4070-1","EUVD-2022-29650","GHSA-6x5p-gp49-3jhh","MGASA-2022-0383","OESA-2022-1657","SUSE-SU-2022:2352-1","SUSE-SU-2022:2353-1","SUSE-SU-2022:2354-1","UBUNTU-CVE-2022-24882","USN-5461-1","openSUSE-SU-2024:13504-1"],"status":"published","title":"Server side NTLM does not properly check parameters in FreeRDP","description":"FreeRDP is a free implementation of the Remote Desktop Protocol (RDP). In versions prior to 2.7.0, NT LAN Manager (NTLM) authentication does not properly abort when someone provides and empty password value. This issue affects FreeRDP based RDP Server implementations. RDP clients are not affected. The vulnerability is patched in FreeRDP 2.7.0. There are currently no known workarounds.","severity":{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.02849,"percentile":0.86808,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-287"],"published":"2022-04-26T00:00:00Z","modified":"2026-11-03T08:02:14Z","fixes":[{"ecosystem":"Debian:12","package":"freerdp2","fixed_in":["2.7.0+dfsg1-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"freerdp2","fixed_in":["2.2.0+dfsg1-0ubuntu0.18.04.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"freerdp2","fixed_in":["2.2.0+dfsg1-0ubuntu0.20.04.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"freerdp2","fixed_in":["2.6.1+dfsg1-3ubuntu1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"freerdp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.0+dfsg1-1"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"freerdp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.0+dfsg1-2+deb11u3"}]}],"versions":["2.3.0+dfsg1-2","2.3.0+dfsg1-2+deb11u1","2.3.0+dfsg1-2+deb11u2"],"bundled":2},{"source":"osv","ecosystem":"Mageia:8","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.0-1.2.mga8"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.0-1.oe1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.0-1.oe1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.0-1.oe2203"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.2-12.23.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP5","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.2-12.23.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP3","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.2-150200.15.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP3","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.2-150200.15.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.2-150200.15.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP4","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-150400.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP4","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-150400.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-150400.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.0~git20140921.1.440916e+dfsg1-5ubuntu1","1.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.2","1.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.3","1.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.4"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"freerdp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.0+dfsg1-0ubuntu0.18.04.3"}]}],"versions":["2.0.0~git20170725.1.1648deb+dfsg1-1","2.0.0~git20170725.1.1648deb+dfsg1-5","2.0.0~git20170725.1.1648deb+dfsg1-5ubuntu1","2.0.0~git20170725.1.1648deb+dfsg1-5ubuntu2","2.0.0~git20170725.1.1648deb+dfsg1-6","2.0.0~git20170725.1.1648deb+dfsg1-6build1","2.0.0~git20170725.1.1648deb+dfsg1-7","2.0.0~git20170725.1.1648deb+dfsg1-7ubuntu0.1","2.1.1+dfsg1-0ubuntu0.18.04.1","2.2.0+dfsg1-0ubuntu0.18.04.1","2.2.0+dfsg1-0ubuntu0.18.04.2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.0~git20140921.1.440916e+dfsg1-15ubuntu1","1.1.0~git20140921.1.440916e+dfsg1-15ubuntu1.18.04.1","1.1.0~git20140921.1.440916e+dfsg1-15ubuntu1.18.04.2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"freerdp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.0+dfsg1-0ubuntu0.20.04.3"}]}],"versions":["2.0.0~git20190204.1.2693389a+dfsg1-1","2.0.0~git20190204.1.2693389a+dfsg1-2","2.0.0~git20190204.1.2693389a+dfsg1-2build1","2.0.0~git20190204.1.2693389a+dfsg1-2build2","2.1.1+dfsg1-0ubuntu0.20.04.1","2.2.0+dfsg1-0ubuntu0.20.04.1","2.2.0+dfsg1-0ubuntu0.20.04.2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"freerdp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.1+dfsg1-3ubuntu1"}]}],"versions":["2.3.0+dfsg1-2build1","2.3.0+dfsg1-2ubuntu1","2.3.0+dfsg1-2ubuntu2","2.4.1+dfsg1-1","2.4.1+dfsg1-1ubuntu1","2.4.1+dfsg1-1ubuntu2","2.5.0+dfsg1-1","2.6.0+dfsg1-1","2.6.1+dfsg1-1","2.6.1+dfsg1-3"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"freerdp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.0+dfsg1-0ubuntu0.18.04.3"}]}],"versions":["2.0.0~git20170725.1.1648deb+dfsg1-1","2.0.0~git20170725.1.1648deb+dfsg1-5","2.0.0~git20170725.1.1648deb+dfsg1-5ubuntu1","2.0.0~git20170725.1.1648deb+dfsg1-5ubuntu2","2.0.0~git20170725.1.1648deb+dfsg1-6","2.0.0~git20170725.1.1648deb+dfsg1-6build1","2.0.0~git20170725.1.1648deb+dfsg1-7","2.0.0~git20170725.1.1648deb+dfsg1-7ubuntu0.1","2.1.1+dfsg1-0ubuntu0.18.04.1","2.2.0+dfsg1-0ubuntu0.18.04.1","2.2.0+dfsg1-0ubuntu0.18.04.2"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"freerdp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.0+dfsg1-0ubuntu0.20.04.3"}]}],"versions":["2.0.0~git20190204.1.2693389a+dfsg1-1","2.0.0~git20190204.1.2693389a+dfsg1-2","2.0.0~git20190204.1.2693389a+dfsg1-2build1","2.0.0~git20190204.1.2693389a+dfsg1-2build2","2.1.1+dfsg1-0ubuntu0.20.04.1","2.2.0+dfsg1-0ubuntu0.20.04.1","2.2.0+dfsg1-0ubuntu0.20.04.2"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"freerdp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.1+dfsg1-3ubuntu2.1"}]}],"versions":["2.3.0+dfsg1-2build1","2.3.0+dfsg1-2ubuntu1","2.3.0+dfsg1-2ubuntu2","2.4.1+dfsg1-1","2.4.1+dfsg1-1ubuntu1","2.4.1+dfsg1-1ubuntu2","2.5.0+dfsg1-1","2.6.0+dfsg1-1","2.6.1+dfsg1-1","2.6.1+dfsg1-3","2.6.1+dfsg1-3ubuntu1","2.6.1+dfsg1-3ubuntu2"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"freerdp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.2-3.1"}]}],"bundled":14}],"products":[{"vendor":"fedoraproject","product":"extra_packages_for_enterprise_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"freerdp","product":"freerdp"}],"references":[{"url":"https://github.com/FreeRDP/FreeRDP/releases/tag/2.7.0","tags":["x_transferred","Release Notes","Third Party Advisory","web","report"]},{"url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-6x5p-gp49-3jhh","tags":["x_transferred","Third Party Advisory","advisory","report"]},{"url":"https://github.com/FreeRDP/FreeRDP/pull/7750","tags":["x_transferred","Patch","Third Party Advisory","fix","report"]},{"url":"https://gitlab.gnome.org/GNOME/gnome-remote-desktop/-/issues/95","tags":["x_transferred","Exploit","Issue Tracking","Third Party Advisory","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AELSWWBAM2YONRPGLWVDY6UNTLJERJYL/","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DOYKBQOHSRM7JQYUIYUWFOXI2JZ2J5RD/","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PZWR6KSIKXO4B2TXBB3WH6YTNYHN46OY/","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://security.gentoo.org/glsa/202210-24","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/02/msg00034.html","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24882.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-24882","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-24882","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2022-0383.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=30392","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/AELSWWBAM2YONRPGLWVDY6UNTLJERJYL/","tags":["web"]},{"url":"https://ubuntu.com/security/notices/USN-5461-1","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3XAZEK5W555DLYFBAHQKYWZRJ4CADMBX/","tags":["web"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1657","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-24883","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20222352-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1198919","tags":["report"]},{"url":"https://bugzilla.suse.com/1198921","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-24882","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-24883","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20222353-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20222354-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-24882","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-24882","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-24883","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2023-39350","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-39351","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-39352","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-39353","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-39354","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-39356","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-40181","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-40186","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-40188","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-40567","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-40569","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-40589","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2022-24882","title":"Server side NTLM does not properly check parameters in FreeRDP","description":"FreeRDP is a free implementation of the Remote Desktop Protocol (RDP). In versions prior to 2.7.0, NT LAN Manager (NTLM) authentication does not properly abort when someone provides and empty password value. This issue affects FreeRDP based RDP Server implementations. RDP clients are not affected. The vulnerability is patched in FreeRDP 2.7.0. There are currently no known workarounds.","status":"published","published":"2022-04-26T00:00:00Z","modified":"2025-11-03T20:34:47.348Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"cna"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:34:34.576287Z"}],"euvd":[{"id":"EUVD-2022-29650","description":"FreeRDP is a free implementation of the Remote Desktop Protocol (RDP). In versions prior to 2.7.0, NT LAN Manager (NTLM) authentication does not properly abort when someone provides and empty password value. This issue affects FreeRDP based RDP Server implementations. RDP clients are not affected. The vulnerability is patched in FreeRDP 2.7.0. There are currently no known workarounds.","status":"published","published":"2022-04-26T00:00:00Z","modified":"2025-11-03T20:34:47Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T19:49:32.503916Z"}],"nvd":[{"id":"CVE-2022-24882","description":"FreeRDP is a free implementation of the Remote Desktop Protocol (RDP). In versions prior to 2.7.0, NT LAN Manager (NTLM) authentication does not properly abort when someone provides and empty password value. This issue affects FreeRDP based RDP Server implementations. RDP clients are not affected. The vulnerability is patched in FreeRDP 2.7.0. There are currently no known workarounds.","status":"published","published":"2022-04-26T16:15:47.813Z","modified":"2026-06-17T04:32:43.407Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:07:18.660414Z"}],"osv":[{"id":"CVE-2022-24882","title":"Server side NTLM does not properly check parameters in FreeRDP","description":"FreeRDP is a free implementation of the Remote Desktop Protocol (RDP). In versions prior to 2.7.0, NT LAN Manager (NTLM) authentication does not properly abort when someone provides and empty password value. This issue affects FreeRDP based RDP Server implementations. RDP clients are not affected. The vulnerability is patched in FreeRDP 2.7.0. There are currently no known workarounds.","status":"published","published":"2022-04-26T00:00:00Z","modified":"2026-10-28T02:31:12.123652638Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T15:44:24.428403Z"},{"id":"DEBIAN-CVE-2022-24882","description":"FreeRDP is a free implementation of the Remote Desktop Protocol (RDP). In versions prior to 2.7.0, NT LAN Manager (NTLM) authentication does not properly abort when someone provides and empty password value. This issue affects FreeRDP based RDP Server implementations. RDP clients are not affected. The vulnerability is patched in FreeRDP 2.7.0. There are currently no known workarounds.","status":"published","published":"2022-04-26T16:15:47.813Z","modified":"2026-11-03T08:02:14.579032473Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-03T08:24:50.542442Z"},{"id":"OESA-2022-1657","title":"freerdp security update","description":"FreeRDP is a client implementation of the Remote Desktop Protocol (RDP) that follows Microsoft's open specifications. This package provides the client applications xfreerdp and wlfreerdp.\n\nSecurity Fix(es):\n\nFreeRDP is a free implementation of the Remote Desktop Protocol (RDP). Prior to version 2.7.0, server side authentication against a `SAM` file might be successful for invalid credentials if the server has configured an invalid `SAM` file path. FreeRDP based clients are not affected. RDP server implementations using FreeRDP to authenticate against a `SAM` file are affected. Version 2.7.0 contains a fix for this issue. As a workaround, use custom authentication via `HashCallback` and/or ensure the `SAM` database path configured is valid and the application has file handles left.(CVE-2022-24883)\n\nFreeRDP is a free implementation of the Remote Desktop Protocol (RDP). In versions prior to 2.7.0, NT LAN Manager (NTLM) authentication does not properly abort when someone provides and empty password value. This issue affects FreeRDP based RDP Server implementations. RDP clients are not affected. The vulnerability is patched in FreeRDP 2.7.0. There are currently no known workarounds.(CVE-2022-24882)","status":"published","published":"2022-05-18T11:04:55Z","modified":"2026-08-18T01:16:31.905016724Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:39.528805Z"},{"id":"UBUNTU-CVE-2022-24882","description":"FreeRDP is a free implementation of the Remote Desktop Protocol (RDP). In versions prior to 2.7.0, NT LAN Manager (NTLM) authentication does not properly abort when someone provides and empty password value. This issue affects FreeRDP based RDP Server implementations. RDP clients are not affected. The vulnerability is patched in FreeRDP 2.7.0. There are currently no known workarounds.","status":"published","published":"2022-04-26T16:15:00Z","modified":"2026-04-22T13:18:19.546301Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T16:53:53.13624Z"},{"id":"DLA-4070-1","title":"freerdp2 - security update","status":"published","published":"2025-02-27T00:00:00Z","modified":"2026-03-09T01:22:33.454609Z","updated_at":"2026-11-02T15:46:12.7027Z"},{"id":"MGASA-2022-0383","title":"Updated freerdp packages fix security vulnerability","description":"FreeRDP is a free implementation of the Remote Desktop Protocol (RDP). In\nversions prior to 2.7.0, NT LAN Manager (NTLM) authentication does not\nproperly abort when someone provides and empty password value. This issue\naffects FreeRDP based RDP Server implementations. RDP clients are not\naffected. The vulnerability is patched in FreeRDP 2.7.0. There are\ncurrently no known workarounds. (CVE-2022-24882)\n\nFreeRDP is a free implementation of the Remote Desktop Protocol (RDP).\nPrior to version 2.7.0, server side authentication against a 'SAM' file\nmight be successful for invalid credentials if the server has configured\nan invalid 'SAM' file path. FreeRDP based clients are not affected. RDP\nserver implementations using FreeRDP to authenticate against a 'SAM' file\nare affected. Version 2.7.0 contains a fix for this issue. As a\nworkaround, use custom authentication via 'HashCallback' and/or ensure the\n'SAM' database path configured is valid and the application has file\nhandles left. (CVE-2022-24883)\n","status":"published","published":"2022-10-23T22:48:35Z","modified":"2026-04-16T04:40:55.031010001Z","updated_at":"2026-11-02T15:49:42.263076Z"},{"id":"openSUSE-SU-2024:13504-1","title":"freerdp-2.11.2-3.1 on GA media","description":"These are all security issues fixed in the freerdp-2.11.2-3.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:03:22.065375Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"SUSE-SU-2022:2352-1","title":"Security update for freerdp","description":"This update for freerdp fixes the following issues:\n\n- CVE-2022-24882: Fixed incorrect check parameters in NTLM (bsc#1198919).\n- CVE-2022-24883: Fixed authentication against invalid SAM files (bsc#1198921).\n","status":"published","published":"2022-07-11T10:06:30Z","modified":"2026-02-04T03:44:24.89841Z","updated_at":"2026-11-02T15:53:50.965375Z"},{"id":"SUSE-SU-2022:2353-1","title":"Security update for freerdp","description":"This update for freerdp fixes the following issues:\n\n- CVE-2022-24882: Fixed incorrect check parameters in NTLM (bsc#1198919).\n- CVE-2022-24883: Fixed authentication against invalid SAM files (bsc#1198921).\n","status":"published","published":"2022-07-11T10:21:02Z","modified":"2026-02-04T03:56:18.714298Z","updated_at":"2026-11-02T15:53:50.965375Z"},{"id":"SUSE-SU-2022:2354-1","title":"Security update for freerdp","description":"This update for freerdp fixes the following issues:\n\n- CVE-2022-24882: Fixed incorrect check parameters in NTLM (bsc#1198919).\n- CVE-2022-24883: Fixed authentication against invalid SAM files (bsc#1198921).\n","status":"published","published":"2022-07-11T10:21:24Z","modified":"2026-02-04T02:47:34.656678Z","updated_at":"2026-11-02T15:53:50.965375Z"},{"id":"USN-5461-1","title":"freerdp2 vulnerabilities","description":"It was discovered that FreeRDP incorrectly handled empty password values. A\nremote attacker could use this issue to bypass server authentication. This\nissue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 21.10.\n(CVE-2022-24882)\n\nIt was discovered that FreeRDP incorrectly handled server configurations\nwith an invalid SAM file path. A remote attacker could use this issue to\nbypass server authentication. (CVE-2022-24883)\n","status":"published","published":"2022-06-06T16:33:28Z","modified":"2026-04-27T16:10:26.560908Z","updated_at":"2026-11-02T16:58:16.20937Z"}]}}