CVE-2022-39347

freerdp: missing path sanitation with `drive` channel

Loading…

Severity

Low

Red Hat Product Security

4.8

CVSS 3.1

Review impact separately from score.

Published · November 16, 2022

Updated · November 21, 2025

Description

A directory traversal issue was discovered in FreeRDP. The vulnerability exists due to missing path canonicalization and base path check for the drive channel. A malicious server can trick a FreeRDP based client to read files outside of the shared directory. This issue allows an attacker to gain access to sensitive information.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

Users who are unable to upgrade should not use the /drive, /drives or +home-drive redirection switches.

CVSS / CWE

CVSS 3.1 · 4.8
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N

CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')