9.8

CVE-2019-16517

Exploit

EPSS 0.22%
Veröffentlicht 23.01.2020 18:15:13
Zuletzt bearbeitet 21.11.2024 04:30:44
Quelle cve@mitre.org
CVE-Watchlists
Login
Unerledigt
Login

An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185. There is a CORS misconfiguration, which reflected the Origin provided by incoming requests. This allowed JavaScript running on any domain to interact with the server APIs and perform administrative actions, without the victim's knowledge.

Betroffene Produkte Warnungen 0 Metriken 3 CWE 1 Referenzen 8

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Connectwise ≫ Control Version19.3.25270.7185

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.22%	0.45

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	9.8	3.9	5.9	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov	7.5	10	6.4	AV:N/AC:L/Au:N/C:P/I:P/A:P

CWE-346 Origin Validation Error

The product does not properly verify that the source of data or communication is valid.

https://know.bishopfox.com/advisories

Third Party Advisory

https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34

Third Party Advisory

Exploit

https://know.bishopfox.com/advisories/connectwise-control

Third Party Advisory

Exploit

https://www.crn.com/news/managed-services/connectwise-control-msp-security-vulnerabilities-are-severe-bishop-fox

Third Party Advisory

https://www.crn.com/slide-shows/managed-services/connectwise-control-attack-chain-exploit-20-questions-for-security-researcher-bishop-fox

Third Party Advisory

https://nvd.nist.gov/vuln/detail/CVE-2019-16517

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2019-16517

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2019-16517

EUVD