CVE-2022-23479

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP). xrdp < v0.9.21 contain a buffer over flow in xrdp_mm_chan_data_in() function. There are no known workarounds for this issue. Users are advised to upgrade.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-120

Affected software

Vendor	Product	Versions
neutrinolabs	xrdp	< 0.9.21

References

https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-pgx2-3fjj-fqqhThird Party Advisory
https://www.debian.org/security/2023/dsa-5502Third Party Advisory
https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-pgx2-3fjj-fqqhThird Party Advisory
https://www.debian.org/security/2023/dsa-5502Third Party Advisory

Timeline

Published: Dec 9, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-234809.8xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP). xrdp < v0.CVE-2022-234819.1xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP). xrdp < v0.CVE-2022-234829.1xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP). xrdp < v0.CVE-2022-234839.1xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP). xrdp < v0.CVE-2022-234849.8xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP). xrdp < v0.CVE-2022-234853.7Sentry is an error tracking and performance monitoring platform. In versions of the sentry python library prior to 22.11.0 an attacker with CVE-2022-234867.5libp2p-rust is the official rust language Implementation of the libp2p networking stack. In versions prior to 0.45.1 an attacker node can ca CVE-2022-234877.5js-libp2p is the official javascript Implementation of libp2p networking stack. Versions older than `v0.38.0` of js-libp2p are vulnerable to CVE-2022-234887.5BigBlueButton is an open source web conferencing system. Versions prior to 2.4-rc-6 are vulnerable to Insertion of Sensitive Information Int CVE-2022-234904.3BigBlueButton is an open source web conferencing system. Versions prior to 2.4.0 expose sensitive information to Unauthorized Actors. This i CVE-2022-234917.5Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of CVE-2022-234927.5go-libp2p is the offical libp2p implementation in the Go programming language. Version `0.18.0` and older of go-libp2p are vulnerable to tar