CVE-2024-39917

xrdp is an open source RDP server. xrdp versions prior to 0.10.0 have a vulnerability that allows attackers to make an infinite number of login attempts. The number of max login attempts is supposed to be limited by a configuration parameter `MaxLoginRetry` in `/etc/xrdp/sesman.ini`. However, this mechanism was not effectively working. As a result, xrdp allows an infinite number of login attempts.
Configurations

Configuration 1 (hide)

cpe:2.3:a:neutrinolabs:xrdp:*:*:*:*:*:*:*:*

History

05 Sep 2024, 15:43

Type Values Removed Values Added
CPE cpe:2.3:a:neutrinolabs:xrdp:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : 7.2
v2 : unknown
v3 : 9.8
References () https://github.com/neutrinolabs/xrdp/commit/19c111c74c913ecc6e4ba9a738ed929a79d2ae8f - () https://github.com/neutrinolabs/xrdp/commit/19c111c74c913ecc6e4ba9a738ed929a79d2ae8f - Patch
References () https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-7w22-h4w7-8j5j - () https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-7w22-h4w7-8j5j - Vendor Advisory
First Time Neutrinolabs
Neutrinolabs xrdp
Summary
  • (es) xrdp es un servidor RDP de código abierto. Las versiones de xrdp anteriores a la 0.10.0 tienen una vulnerabilidad que permite a los atacantes realizar una cantidad infinita de intentos de inicio de sesión. Se supone que el número máximo de intentos de inicio de sesión está limitado por un parámetro de configuración `MaxLoginRetry` en `/etc/xrdp/sesman.ini`. Sin embargo, este mecanismo no estaba funcionando eficazmente. Como resultado, xrdp permite una cantidad infinita de intentos de inicio de sesión.

12 Jul 2024, 16:15

Type Values Removed Values Added
New CVE

Information

Published : 2024-07-12 16:15

Updated : 2024-09-05 15:43


NVD link : CVE-2024-39917

Mitre link : CVE-2024-39917

CVE.ORG link : CVE-2024-39917


JSON object : View

Products Affected

neutrinolabs

  • xrdp
CWE
CWE-307

Improper Restriction of Excessive Authentication Attempts