7.2

CVE-2019-16514

Exploit

EPSS 8.95%
Veröffentlicht 23.01.2020 18:15:13
Zuletzt bearbeitet 21.11.2024 04:30:44
Quelle cve@mitre.org
CVE-Watchlists
Login
Unerledigt
Login

An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185. The server allows remote code execution. Administrative users could upload an unsigned extension ZIP file containing executable code that is subsequently executed by the server.

Betroffene Produkte Warnungen 0 Metriken 3 CWE 1 Referenzen 8

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Connectwise ≫ Control Version19.3.25270.7185

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	8.95%	0.923

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	7.2	1.2	5.9	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov	6.5	8	6.4	AV:N/AC:L/Au:S/C:P/I:P/A:P

CWE-434 Unrestricted Upload of File with Dangerous Type

The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

https://know.bishopfox.com/advisories

Third Party Advisory

https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34

Third Party Advisory

Exploit

https://know.bishopfox.com/advisories/connectwise-control

Third Party Advisory

Exploit

https://www.crn.com/news/managed-services/connectwise-control-msp-security-vulnerabilities-are-severe-bishop-fox

Third Party Advisory

https://www.crn.com/slide-shows/managed-services/connectwise-control-attack-chain-exploit-20-questions-for-security-researcher-bishop-fox

Third Party Advisory

https://nvd.nist.gov/vuln/detail/CVE-2019-16514

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2019-16514

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2019-16514

EUVD