9.8

CVE-2022-24883: fedoraproject fedora Improper Authentication

CVSS: 9.8v3.1CriticalModified
AliasesUBUNTU-CVE-2022-24883DEBIAN-CVE-2022-24883
Published 26-04-2022Last modified 03-11-2025
Open JSON

Vulnerability summary

CVE-2022-24883 is a critical (CVSS 9.8) Improper Authentication vulnerability in fedoraproject fedora. EPSS estimates a 2.34% chance of exploitation in the next 30 days, higher than 83.3% of scored vulnerabilities.

Overall risk
70/100
0100
High · default modelHow is this calculated?
CVSS score
9.8/10
010
Critical · v3.1 (NVD)
EPSS score
2.34%
0%100%
Low · -0.02 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 8 · Related 5
DLA-3654-1DLA-4053-1MGASA-2022-0383OPENSUSE-SU-2024:13504-1SUSE-SU-2022:2352-1SUSE-SU-2022:2353-1

Timeline

  1. 26-04-2022
    PublishedVulnerability first disclosed.
  2. 03-11-2025
    Last modifiedVulnerability information updated.

Description

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP). Prior to version 2.7.0, server side authentication against a `SAM` file might be successful for invalid credentials if the server has configured an invalid `SAM` file path. FreeRDP based clients are not affected. RDP server implementations using FreeRDP to authenticate against a `SAM` file are affected. Version 2.7.0 contains a fix for this issue. As a workaround, use custom authentication via `HashCallback` and/or ensure the `SAM` database path configured is valid and the application has file handles left.

CVSS metrics

5 scores · 4 sources · 2 versions

EPSS trend

Probability

2.34%

Chance of exploitation in the next 30 days

Percentile

83%

Versus all other CVEs

30-day change

-0.02 pp

From 2.36% on 19-09-2026

19-09-202619-10-2026
EPSS score
2.34%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Ubuntu2 products
  • freerdpAll versions (No fix recorded)
  • freerdp2< 2.2.0+dfsg1-0ubuntu0.18.04.3 | < 2.2.0+dfsg1-0ubuntu0.20.04.3 | < 2.6.1+dfsg1-3ubuntu2.1
Debian1 product
  • freerdp2< 2.7.0+dfsg1-1
Fedoraproject1 product
Freerdp1 product

4 vendors · 5 products

References

14 links
Show all 14 references