CVE-2022-24882 Server side NTLM does not properly check parameters in FreeRDP

2022-04-2600:00:00

CWE-287

GitHub_M

www.cve.org

freerdp

server

ntlm

authentication

vulnerability

remote desktop protocol

rdp

patched

CVSS3

9.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

AI Score

9.8

Confidence

High

EPSS

0.004

Percentile

73.8%

JSON

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP). In versions prior to 2.7.0, NT LAN Manager (NTLM) authentication does not properly abort when someone provides and empty password value. This issue affects FreeRDP based RDP Server implementations. RDP clients are not affected. The vulnerability is patched in FreeRDP 2.7.0. There are currently no known workarounds.

CNA Affected

[
  {
    "vendor": "FreeRDP",
    "product": "FreeRDP",
    "versions": [
      {
        "version": "< 2.7.0",
        "status": "affected"
      }
    ]
  }
]