CVE-2022-24883

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 2.7.0

Description The issue is related to the authentication procedure in FreeRDP, a free implementation of the Remote Desktop Protocol (RDP). Server-side authentication against a SAM file might be successful for invalid credentials if the server has configured an invalid SAM file path. This affects RDP server implementations using FreeRDP to authenticate against a SAM file, but FreeRDP-based clients are not affected.

Recommendations For versions prior to 2.7.0, update to version 2.7.0 to resolve the issue. As a temporary workaround, consider using custom authentication via HashCallback and/or ensure the SAM database path configured is valid and the application has file handles left.