CVE-2019-16517
CRITICAL 9.8EPSS 1.3%
An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185. There is a CORS misconfiguration, which reflected the Origin provided by incoming requests. This allowed JavaScript running on any domain to interact with the server APIs and perform administrative actions, without the victim's knowledge.
- CVSS v3.1 NVD
- 9.8 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS v2.0 NVD
- 7.5 HIGH
AV:N/AC:L/Au:N/C:P/I:P/A:P - EPSS
- 1.34% chance of exploitation in the next 30 days, 71st percentile
- Published
- 2020-01-23
- Updated
- 2024-08-05
Proof-of-concept exploits (2)
- https://know.bishopfox.com/advisories/connectwise-control
- https://www.crn.com/slide-shows/managed-services/connectwise-control-attack-chain-exploit…
Security advisories
- https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9…
- https://know.bishopfox.com/advisories
- https://www.crn.com/news/managed-services/connectwise-control-msp-security-vulnerabilitie…