Vulnerability Description
FreeRDP is a free implementation of the Remote Desktop Protocol (RDP). In versions prior to 2.7.0, NT LAN Manager (NTLM) authentication does not properly abort when someone provides and empty password value. This issue affects FreeRDP based RDP Server implementations. RDP clients are not affected. The vulnerability is patched in FreeRDP 2.7.0. There are currently no known workarounds.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Freerdp | Freerdp | < 2.7.0 |
| Fedoraproject | Extra Packages For Enterprise Linux | 8.0 |
| Fedoraproject | Fedora | 34 |
Related Weaknesses (CWE)
References
- https://github.com/FreeRDP/FreeRDP/pull/7750PatchThird Party Advisory
- https://github.com/FreeRDP/FreeRDP/releases/tag/2.7.0Release NotesThird Party Advisory
- https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-6x5p-gp49-3jhhThird Party Advisory
- https://gitlab.gnome.org/GNOME/gnome-remote-desktop/-/issues/95ExploitIssue TrackingThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://security.gentoo.org/glsa/202210-24Third Party Advisory
- https://github.com/FreeRDP/FreeRDP/pull/7750PatchThird Party Advisory
- https://github.com/FreeRDP/FreeRDP/releases/tag/2.7.0Release NotesThird Party Advisory
- https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-6x5p-gp49-3jhhThird Party Advisory
- https://gitlab.gnome.org/GNOME/gnome-remote-desktop/-/issues/95ExploitIssue TrackingThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2025/02/msg00034.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
FAQ
What is CVE-2022-24882?
CVE-2022-24882 is a vulnerability with a CVSS score of 9.1 (CRITICAL). FreeRDP is a free implementation of the Remote Desktop Protocol (RDP). In versions prior to 2.7.0, NT LAN Manager (NTLM) authentication does not properly abort when someone provides and empty password...
How severe is CVE-2022-24882?
CVE-2022-24882 has been rated CRITICAL with a CVSS base score of 9.1/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2022-24882?
Check the references section above for vendor advisories and patch information. Affected products include: Freerdp Freerdp, Fedoraproject Extra Packages For Enterprise Linux, Fedoraproject Fedora.