{"id":"CVE-2022-24883","aliases":["CLSA-2026-1778146905","DEBIAN-CVE-2022-24883","DLA-3654-1","DLA-4053-1","EUVD-2022-29651","GHSA-qxm3-v2r6-vmwf","MGASA-2022-0383","OESA-2022-1657","SUSE-SU-2022:2352-1","SUSE-SU-2022:2353-1","SUSE-SU-2022:2354-1","UBUNTU-CVE-2022-24883","USN-5461-1","openSUSE-SU-2024:13504-1"],"status":"published","title":"FreeRDP Server authentication might allow invalid credentials to pass","description":"FreeRDP is a free implementation of the Remote Desktop Protocol (RDP). Prior to version 2.7.0, server side authentication against a `SAM` file might be successful for invalid credentials if the server has configured an invalid `SAM` file path. FreeRDP based clients are not affected. RDP server implementations using FreeRDP to authenticate against a `SAM` file are affected. Version 2.7.0 contains a fix for this issue. As a workaround, use custom authentication via `HashCallback` and/or ensure the `SAM` database path configured is valid and the application has file handles left.","severity":{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.02337,"percentile":0.83732,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-287"],"published":"2022-04-26T00:00:00Z","modified":"2026-11-03T08:02:44Z","fixes":[{"ecosystem":"TuxCare:OracleLinux:7","package":"freerdp","fixed_in":["2.1.1-5.el7_9.tuxcare.els21"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:7","package":"freerdp-devel","fixed_in":["2.1.1-5.el7_9.tuxcare.els21"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:7","package":"freerdp-libs","fixed_in":["2.1.1-5.el7_9.tuxcare.els21"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:7","package":"libwinpr","fixed_in":["2.1.1-5.el7_9.tuxcare.els21"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:7","package":"libwinpr-devel","fixed_in":["2.1.1-5.el7_9.tuxcare.els21"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"freerdp2","fixed_in":["2.7.0+dfsg1-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"freerdp2","fixed_in":["2.2.0+dfsg1-0ubuntu0.18.04.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"freerdp2","fixed_in":["2.2.0+dfsg1-0ubuntu0.20.04.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"freerdp2","fixed_in":["2.6.1+dfsg1-3ubuntu2.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-5.el7_9.tuxcare.els21"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"freerdp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-5.el7_9.tuxcare.els21"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"freerdp-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-5.el7_9.tuxcare.els21"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"libwinpr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-5.el7_9.tuxcare.els21"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"libwinpr-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-5.el7_9.tuxcare.els21"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"freerdp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.0+dfsg1-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"freerdp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.0+dfsg1-2+deb10u4"}]}],"versions":["2.0.0~git20190204.1.2693389a+dfsg1-1","2.0.0~git20190204.1.2693389a+dfsg1-1+deb10u1","2.0.0~git20190204.1.2693389a+dfsg1-1+deb10u2","2.0.0~git20190204.1.2693389a+dfsg1-2","2.0.0~git20190204.1.2693389a+dfsg1-2~bpo10+1","2.1.1+dfsg1-1","2.1.2+dfsg1-1","2.1.2+dfsg1-2","2.2.0+dfsg1-1","2.2.0+dfsg1-1~bpo10+1","2.3.0+dfsg1-1","2.3.0+dfsg1-1~bpo10+1","2.3.0+dfsg1-2","2.3.0+dfsg1-2+deb10u3"],"bundled":9},{"source":"osv","ecosystem":"Debian:11","package":"freerdp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.0+dfsg1-2+deb11u2"}]}],"versions":["2.3.0+dfsg1-2","2.3.0+dfsg1-2+deb11u1"],"bundled":32},{"source":"osv","ecosystem":"Mageia:8","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.0-1.2.mga8"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.0-1.oe1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.0-1.oe1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.0-1.oe2203"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.2-12.23.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP5","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.2-12.23.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP3","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.2-150200.15.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP3","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.2-150200.15.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.2-150200.15.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP4","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-150400.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP4","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-150400.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-150400.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.0~git20140921.1.440916e+dfsg1-5ubuntu1","1.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.2","1.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.3","1.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.4"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"freerdp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.0+dfsg1-0ubuntu0.18.04.3"}]}],"versions":["2.0.0~git20170725.1.1648deb+dfsg1-1","2.0.0~git20170725.1.1648deb+dfsg1-5","2.0.0~git20170725.1.1648deb+dfsg1-5ubuntu1","2.0.0~git20170725.1.1648deb+dfsg1-5ubuntu2","2.0.0~git20170725.1.1648deb+dfsg1-6","2.0.0~git20170725.1.1648deb+dfsg1-6build1","2.0.0~git20170725.1.1648deb+dfsg1-7","2.0.0~git20170725.1.1648deb+dfsg1-7ubuntu0.1","2.1.1+dfsg1-0ubuntu0.18.04.1","2.2.0+dfsg1-0ubuntu0.18.04.1","2.2.0+dfsg1-0ubuntu0.18.04.2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.0~git20140921.1.440916e+dfsg1-15ubuntu1","1.1.0~git20140921.1.440916e+dfsg1-15ubuntu1.18.04.1","1.1.0~git20140921.1.440916e+dfsg1-15ubuntu1.18.04.2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"freerdp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.0+dfsg1-0ubuntu0.20.04.3"}]}],"versions":["2.0.0~git20190204.1.2693389a+dfsg1-1","2.0.0~git20190204.1.2693389a+dfsg1-2","2.0.0~git20190204.1.2693389a+dfsg1-2build1","2.0.0~git20190204.1.2693389a+dfsg1-2build2","2.1.1+dfsg1-0ubuntu0.20.04.1","2.2.0+dfsg1-0ubuntu0.20.04.1","2.2.0+dfsg1-0ubuntu0.20.04.2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"freerdp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.1+dfsg1-3ubuntu2.1"}]}],"versions":["2.3.0+dfsg1-2build1","2.3.0+dfsg1-2ubuntu1","2.3.0+dfsg1-2ubuntu2","2.4.1+dfsg1-1","2.4.1+dfsg1-1ubuntu1","2.4.1+dfsg1-1ubuntu2","2.5.0+dfsg1-1","2.6.0+dfsg1-1","2.6.1+dfsg1-1","2.6.1+dfsg1-3","2.6.1+dfsg1-3ubuntu1","2.6.1+dfsg1-3ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"freerdp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.0+dfsg1-0ubuntu0.18.04.3"}]}],"versions":["2.0.0~git20170725.1.1648deb+dfsg1-1","2.0.0~git20170725.1.1648deb+dfsg1-5","2.0.0~git20170725.1.1648deb+dfsg1-5ubuntu1","2.0.0~git20170725.1.1648deb+dfsg1-5ubuntu2","2.0.0~git20170725.1.1648deb+dfsg1-6","2.0.0~git20170725.1.1648deb+dfsg1-6build1","2.0.0~git20170725.1.1648deb+dfsg1-7","2.0.0~git20170725.1.1648deb+dfsg1-7ubuntu0.1","2.1.1+dfsg1-0ubuntu0.18.04.1","2.2.0+dfsg1-0ubuntu0.18.04.1","2.2.0+dfsg1-0ubuntu0.18.04.2"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"freerdp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.0+dfsg1-0ubuntu0.20.04.3"}]}],"versions":["2.0.0~git20190204.1.2693389a+dfsg1-1","2.0.0~git20190204.1.2693389a+dfsg1-2","2.0.0~git20190204.1.2693389a+dfsg1-2build1","2.0.0~git20190204.1.2693389a+dfsg1-2build2","2.1.1+dfsg1-0ubuntu0.20.04.1","2.2.0+dfsg1-0ubuntu0.20.04.1","2.2.0+dfsg1-0ubuntu0.20.04.2"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"freerdp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.1+dfsg1-3ubuntu2.1"}]}],"versions":["2.3.0+dfsg1-2build1","2.3.0+dfsg1-2ubuntu1","2.3.0+dfsg1-2ubuntu2","2.4.1+dfsg1-1","2.4.1+dfsg1-1ubuntu1","2.4.1+dfsg1-1ubuntu2","2.5.0+dfsg1-1","2.6.0+dfsg1-1","2.6.1+dfsg1-1","2.6.1+dfsg1-3","2.6.1+dfsg1-3ubuntu1","2.6.1+dfsg1-3ubuntu2"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"freerdp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.2-3.1"}]}],"bundled":14}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"freerdp","product":"freerdp"}],"references":[{"url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-qxm3-v2r6-vmwf","tags":["x_transferred","Patch","Third Party Advisory","advisory","report"]},{"url":"https://github.com/FreeRDP/FreeRDP/commit/4661492e5a617199457c8074bad22f766a116cdc","tags":["x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://github.com/FreeRDP/FreeRDP/commit/6f473b273a4b6f0cb6aca32b95e22fd0de88e144","tags":["x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://github.com/FreeRDP/FreeRDP/releases/tag/2.7.0","tags":["x_transferred","Release Notes","Third Party Advisory","web","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AELSWWBAM2YONRPGLWVDY6UNTLJERJYL/","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DOYKBQOHSRM7JQYUIYUWFOXI2JZ2J5RD/","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PZWR6KSIKXO4B2TXBB3WH6YTNYHN46OY/","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://security.gentoo.org/glsa/202210-24","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/11/msg00010.html","tags":["mailing-list","x_transferred","article"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/02/msg00016.html","tags":["web"]},{"url":"https://errata.tuxcare.com/els_os/oraclelinux7els/CLSA-2026-1778146905.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24883.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-24883","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-24883","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2022-0383.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=30392","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/AELSWWBAM2YONRPGLWVDY6UNTLJERJYL/","tags":["web"]},{"url":"https://ubuntu.com/security/notices/USN-5461-1","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3XAZEK5W555DLYFBAHQKYWZRJ4CADMBX/","tags":["web"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1657","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-24882","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20222352-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1198919","tags":["report"]},{"url":"https://bugzilla.suse.com/1198921","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-24882","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-24883","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20222353-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20222354-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-24883","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-24883","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-24882","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2023-39350","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-39351","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-39352","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-39353","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-39354","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-39356","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-40181","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-40186","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-40188","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-40567","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-40569","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-40589","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2022-24883","title":"FreeRDP Server authentication might allow invalid credentials to pass","description":"FreeRDP is a free implementation of the Remote Desktop Protocol (RDP). Prior to version 2.7.0, server side authentication against a `SAM` file might be successful for invalid credentials if the server has configured an invalid `SAM` file path. FreeRDP based clients are not affected. RDP server implementations using FreeRDP to authenticate against a `SAM` file are affected. Version 2.7.0 contains a fix for this issue. As a workaround, use custom authentication via `HashCallback` and/or ensure the `SAM` database path configured is valid and the application has file handles left.","status":"published","published":"2022-04-26T00:00:00Z","modified":"2025-11-03T20:34:48.778Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:34:34.576287Z"}],"euvd":[{"id":"EUVD-2022-29651","description":"FreeRDP is a free implementation of the Remote Desktop Protocol (RDP). Prior to version 2.7.0, server side authentication against a `SAM` file might be successful for invalid credentials if the server has configured an invalid `SAM` file path. FreeRDP based clients are not affected. RDP server implementations using FreeRDP to authenticate against a `SAM` file are affected. Version 2.7.0 contains a fix for this issue. As a workaround, use custom authentication via `HashCallback` and/or ensure the `SAM` database path configured is valid and the application has file handles left.","status":"published","published":"2022-04-26T00:00:00Z","modified":"2025-11-03T20:34:48Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T19:49:32.503916Z"}],"nvd":[{"id":"CVE-2022-24883","description":"FreeRDP is a free implementation of the Remote Desktop Protocol (RDP). Prior to version 2.7.0, server side authentication against a `SAM` file might be successful for invalid credentials if the server has configured an invalid `SAM` file path. FreeRDP based clients are not affected. RDP server implementations using FreeRDP to authenticate against a `SAM` file are affected. Version 2.7.0 contains a fix for this issue. As a workaround, use custom authentication via `HashCallback` and/or ensure the `SAM` database path configured is valid and the application has file handles left.","status":"published","published":"2022-04-26T16:15:47.883Z","modified":"2026-06-17T04:32:43.533Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:07:18.660414Z"}],"osv":[{"id":"CVE-2022-24883","title":"FreeRDP Server authentication might allow invalid credentials to pass","description":"FreeRDP is a free implementation of the Remote Desktop Protocol (RDP). Prior to version 2.7.0, server side authentication against a `SAM` file might be successful for invalid credentials if the server has configured an invalid `SAM` file path. FreeRDP based clients are not affected. RDP server implementations using FreeRDP to authenticate against a `SAM` file are affected. Version 2.7.0 contains a fix for this issue. As a workaround, use custom authentication via `HashCallback` and/or ensure the `SAM` database path configured is valid and the application has file handles left.","status":"published","published":"2022-04-26T00:00:00Z","modified":"2026-10-28T10:25:55.494543034Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T15:44:24.428403Z"},{"id":"DEBIAN-CVE-2022-24883","description":"FreeRDP is a free implementation of the Remote Desktop Protocol (RDP). Prior to version 2.7.0, server side authentication against a `SAM` file might be successful for invalid credentials if the server has configured an invalid `SAM` file path. FreeRDP based clients are not affected. RDP server implementations using FreeRDP to authenticate against a `SAM` file are affected. Version 2.7.0 contains a fix for this issue. As a workaround, use custom authentication via `HashCallback` and/or ensure the `SAM` database path configured is valid and the application has file handles left.","status":"published","published":"2022-04-26T16:15:47.883Z","modified":"2026-11-03T08:02:44.387655621Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T08:24:39.643572Z"},{"id":"OESA-2022-1657","title":"freerdp security update","description":"FreeRDP is a client implementation of the Remote Desktop Protocol (RDP) that follows Microsoft's open specifications. This package provides the client applications xfreerdp and wlfreerdp.\n\nSecurity Fix(es):\n\nFreeRDP is a free implementation of the Remote Desktop Protocol (RDP). Prior to version 2.7.0, server side authentication against a `SAM` file might be successful for invalid credentials if the server has configured an invalid `SAM` file path. FreeRDP based clients are not affected. RDP server implementations using FreeRDP to authenticate against a `SAM` file are affected. Version 2.7.0 contains a fix for this issue. As a workaround, use custom authentication via `HashCallback` and/or ensure the `SAM` database path configured is valid and the application has file handles left.(CVE-2022-24883)\n\nFreeRDP is a free implementation of the Remote Desktop Protocol (RDP). In versions prior to 2.7.0, NT LAN Manager (NTLM) authentication does not properly abort when someone provides and empty password value. This issue affects FreeRDP based RDP Server implementations. RDP clients are not affected. The vulnerability is patched in FreeRDP 2.7.0. There are currently no known workarounds.(CVE-2022-24882)","status":"published","published":"2022-05-18T11:04:55Z","modified":"2026-08-18T01:16:31.905016724Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:39.528805Z"},{"id":"UBUNTU-CVE-2022-24883","description":"FreeRDP is a free implementation of the Remote Desktop Protocol (RDP). Prior to version 2.7.0, server side authentication against a `SAM` file might be successful for invalid credentials if the server has configured an invalid `SAM` file path. FreeRDP based clients are not affected. RDP server implementations using FreeRDP to authenticate against a `SAM` file are affected. Version 2.7.0 contains a fix for this issue. As a workaround, use custom authentication via `HashCallback` and/or ensure the `SAM` database path configured is valid and the application has file handles left.","status":"published","published":"2022-04-26T16:15:00Z","modified":"2026-04-22T13:18:42.640466Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T16:53:53.13624Z"},{"id":"CLSA-2026-1778146905","title":"freerdp: Fix of CVE-2022-24883","description":"- Reuse centos7els branch for oraclelinux7els\n- CVE-2022-24883: fix server-side NTLM auth bypass against a SAM database\n  by rejecting auth when SamOpen fails or the user entry is missing","status":"published","published":"2026-05-07T11:13:51Z","modified":"2026-06-01T00:33:14.115732537Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"DLA-3654-1","title":"freerdp2 - security update","status":"published","published":"2023-11-17T00:00:00Z","modified":"2026-03-09T01:20:39.038402Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"DLA-4053-1","title":"freerdp2 - security update","status":"published","published":"2025-02-15T00:00:00Z","modified":"2026-03-09T01:19:24.57066Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"MGASA-2022-0383","title":"Updated freerdp packages fix security vulnerability","description":"FreeRDP is a free implementation of the Remote Desktop Protocol (RDP). In\nversions prior to 2.7.0, NT LAN Manager (NTLM) authentication does not\nproperly abort when someone provides and empty password value. This issue\naffects FreeRDP based RDP Server implementations. RDP clients are not\naffected. The vulnerability is patched in FreeRDP 2.7.0. There are\ncurrently no known workarounds. (CVE-2022-24882)\n\nFreeRDP is a free implementation of the Remote Desktop Protocol (RDP).\nPrior to version 2.7.0, server side authentication against a 'SAM' file\nmight be successful for invalid credentials if the server has configured\nan invalid 'SAM' file path. FreeRDP based clients are not affected. RDP\nserver implementations using FreeRDP to authenticate against a 'SAM' file\nare affected. Version 2.7.0 contains a fix for this issue. As a\nworkaround, use custom authentication via 'HashCallback' and/or ensure the\n'SAM' database path configured is valid and the application has file\nhandles left. (CVE-2022-24883)\n","status":"published","published":"2022-10-23T22:48:35Z","modified":"2026-04-16T04:40:55.031010001Z","updated_at":"2026-11-02T15:49:42.263076Z"},{"id":"openSUSE-SU-2024:13504-1","title":"freerdp-2.11.2-3.1 on GA media","description":"These are all security issues fixed in the freerdp-2.11.2-3.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:03:22.065375Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"SUSE-SU-2022:2352-1","title":"Security update for freerdp","description":"This update for freerdp fixes the following issues:\n\n- CVE-2022-24882: Fixed incorrect check parameters in NTLM (bsc#1198919).\n- CVE-2022-24883: Fixed authentication against invalid SAM files (bsc#1198921).\n","status":"published","published":"2022-07-11T10:06:30Z","modified":"2026-02-04T03:44:24.89841Z","updated_at":"2026-11-02T15:53:50.965375Z"},{"id":"SUSE-SU-2022:2353-1","title":"Security update for freerdp","description":"This update for freerdp fixes the following issues:\n\n- CVE-2022-24882: Fixed incorrect check parameters in NTLM (bsc#1198919).\n- CVE-2022-24883: Fixed authentication against invalid SAM files (bsc#1198921).\n","status":"published","published":"2022-07-11T10:21:02Z","modified":"2026-02-04T03:56:18.714298Z","updated_at":"2026-11-02T15:53:50.965375Z"},{"id":"SUSE-SU-2022:2354-1","title":"Security update for freerdp","description":"This update for freerdp fixes the following issues:\n\n- CVE-2022-24882: Fixed incorrect check parameters in NTLM (bsc#1198919).\n- CVE-2022-24883: Fixed authentication against invalid SAM files (bsc#1198921).\n","status":"published","published":"2022-07-11T10:21:24Z","modified":"2026-02-04T02:47:34.656678Z","updated_at":"2026-11-02T15:53:50.965375Z"},{"id":"USN-5461-1","title":"freerdp2 vulnerabilities","description":"It was discovered that FreeRDP incorrectly handled empty password values. A\nremote attacker could use this issue to bypass server authentication. This\nissue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 21.10.\n(CVE-2022-24882)\n\nIt was discovered that FreeRDP incorrectly handled server configurations\nwith an invalid SAM file path. A remote attacker could use this issue to\nbypass server authentication. (CVE-2022-24883)\n","status":"published","published":"2022-06-06T16:33:28Z","modified":"2026-04-27T16:10:26.560908Z","updated_at":"2026-11-02T16:58:16.20937Z"}]}}