CVE-2024-39917

published 2024-07-12

CVE-2024-39917: xrdp is an open source RDP server. xrdp versions prior to 0.10.0 have a vulnerability that allows attackers to make an infinite number of login attempts. The…

Priority P3 54 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

xrdp is an open source RDP server. xrdp versions prior to 0.10.0 have a vulnerability that allows attackers to make an infinite number of login attempts. The number of max login attempts is supposed to be limited by a configuration parameter `MaxLoginRetry` in `/etc/xrdp/sesman.ini`. However, this mechanism was not effectively working. As a result, xrdp allows an infinite number of login attempts.

Affected

8 ranges

Vendor	Product	Version range	Fixed in
debian	xrdp	< xrdp 0.9.21.1-1+deb12u1 (bookworm)	xrdp 0.9.21.1-1+deb12u1 (bookworm)
neutrinolabs	xrdp	< 0.10.0	0.10.0
neutrinolabs	xrdp	<= 0.10.0	—
neutrinolabs	xrdp	>= 0 < 0.9.21.1-1~deb11u2	0.9.21.1-1~deb11u2
neutrinolabs	xrdp	>= 0 < 0.9.21.1-1+deb12u1	0.9.21.1-1+deb12u1
neutrinolabs	xrdp	>= 0 < 0.10.1-1	0.10.1-1
neutrinolabs	xrdp	>= 0 < 0.10.1-1	0.10.1-1
ubuntu	xrdp	—	—

CVSS provenance

nvd v3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

osv 9.8 CRITICAL

vendor_debian 7.2 HIGH

vendor_ubuntu 6.5 MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-307