CVE-2022-23468
Last modified
CVE-2022-23468 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP). xrdp < v0.9.21 contain a buffer over flow in xrdp_login_wnd_create() function. There are no known workarounds for this issue. EPSS estimates a 0.76% chance of exploitation in the next 30 days.
Description
xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP). xrdp < v0.9.21 contain a buffer over flow in xrdp_login_wnd_create() function. There are no known workarounds for this issue. Users are advised to upgrade.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Neutrinolabs | Xrdp | < 0.9.21 |
| Debian | Debian Linux | 11.0 |
References
- https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-8c2f-mw8m-qpx6Third Party Advisory
- https://www.debian.org/security/2023/dsa-5502Third Party Advisory
- https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-8c2f-mw8m-qpx6Third Party Advisory
- https://www.debian.org/security/2023/dsa-5502Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2022-23468?
How severe is CVE-2022-23468?
How do I fix CVE-2022-23468?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2022
- CVE-2022-23462IOWOW is a C utility library and persistent key/value storag…7.5
- CVE-2022-23463Nepxion Discovery is a solution for Spring Cloud. Discover i…9.8
- CVE-2022-23464Nepxion Discovery is a solution for Spring Cloud. Discovery …7.5
- CVE-2022-23465SwiftTerm is a Xterm/VT100 Terminal emulator. Prior to commi…7.8
- CVE-2022-23466teler is an real-time intrusion detection and threat alert d…5.4
- CVE-2022-23467OpenRazer is an open source driver and user-space daemon to …4.6
- CVE-2022-23469Traefik is an open source HTTP reverse proxy and load balanc…6.5
- CVE-2022-2347There exists an unchecked length field in UBoot. The U-Boot …7.1
- CVE-2022-23470Galaxy is an open-source platform for data analysis. An arbi…7.5
- CVE-2022-23471containerd is an open source container runtime. A bug was fo…6.5
- CVE-2022-23472Passeo is an open source python password generator. Versions…7.5
- CVE-2022-23473Tuleap is an Open Source Suite to improve management of soft…4.3
Are you affected by CVE-2022-23468?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST