CVE-2022-23613

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

xrdp is an open source remote desktop protocol (RDP) server. In affected versions an integer underflow leading to a heap overflow in the sesman server allows any unauthenticated attacker which is able to locally access a sesman server to execute code as root. This vulnerability has been patched in version 0.9.18.1 and above. Users are advised to upgrade. There are no known workarounds.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-191

Affected software

No affected versions have been published.

Timeline

Published
Feb 7, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-236149.8Twig is an open source template language for PHP. When in a sandbox mode, the `arrow` parameter of the `sort` filter must be a closure to avCVE-2022-236155.4XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions any user with CVE-2022-236168.8XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions it's possible CVE-2022-236176.5XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions any user with CVE-2022-236186.1XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions there is no prCVE-2022-236197.5XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions it's possible CVE-2022-23627.5The Download Manager WordPress plugin before 3.2.50 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDR, whiCVE-2022-236205.4XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions AbstractSxExpoCVE-2022-236214.9XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions any user with CVE-2022-236226.1XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions there is a croCVE-2022-236238.8Frourio is a full stack framework, for TypeScript. Frourio users who uses frourio version prior to v0.26.0 and integration with class-validaCVE-2022-236248.8Frourio-express is a minimal full stack framework, for TypeScript. Frourio-express users who uses frourio-express version prior to v0.26.0 a