« Volver al listado

CVE-2022-39317

Estado: ModificadaMedia (4.6)—

FreeRDP es una librería y clientes de protocolos de escritorio remoto gratuitos. A las versiones afectadas de FreeRDP les falta una verificación de rango para el índice de compensación de entrada en el decodificador ZGFX. Un servidor malicioso puede engañar a un cliente basado en FreeRDP para que lea datos no vinculados e intente decodificarlos. Este problema se solucionó en la versión 2.9.0. No se conocen soluciones para este problema.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Fedoraproject — FedoraFreerdp — Freerdp

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-39317",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2022-39317",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-04-23T13:54:24.231479Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.6,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "HIGH",
          "availabilityImpact": "LOW",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 3.4,
        "exploitabilityScore": 1.2
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.6,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:L",
          "integrityImpact": "NONE",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.5,
        "exploitabilityScore": 2.1
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "FreeRDP",
          "product": "FreeRDP",
          "versions": [
            {
              "status": "affected",
              "version": "< 2.9.0"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-11-16T21:15:10.300",
  "references": [
    {
      "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-99cm-4gw7-c8jh",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UDOTAOJBCZKREZJPT6VZ25GESI5T6RBG/",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YGQN3OWQNHSMWKOF4D35PF5ASKNLC74B/",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://security.gentoo.org/glsa/202401-16",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-99cm-4gw7-c8jh",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UDOTAOJBCZKREZJPT6VZ25GESI5T6RBG/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YGQN3OWQNHSMWKOF4D35PF5ASKNLC74B/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://security.gentoo.org/glsa/202401-16",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-125"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-125"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP are missing a range check for input offset index in ZGFX decoder. A malicious server can trick a FreeRDP based client to read out of bound data and try to decode it. This issue has been addressed in version 2.9.0. There are no known workarounds for this issue."
    },
    {
      "lang": "es",
      "value": "FreeRDP es una librería y clientes de protocolos de escritorio remoto gratuitos. A las versiones afectadas de FreeRDP les falta una verificación de rango para el índice de compensación de entrada en el decodificador ZGFX. Un servidor malicioso puede engañar a un cliente basado en FreeRDP para que lea datos no vinculados e intente decodificarlos. Este problema se solucionó en la versión 2.9.0. No se conocen soluciones para este problema."
    }
  ],
  "lastModified": "2026-06-17T04:58:07.947",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AF273D61-AA72-44FE-937E-D5749D565AEE",
              "versionEndExcluding": "2.9.0"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5C675112-476C-4D7C-BCB9-A2FB2D0BC9FD"
            },
            {
              "criteria": "cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E30D0E6F-4AE8-4284-8716-991DFA48CC5D"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}