CVE-2019-16517
Summary
| CVE | CVE-2019-16517 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2020-01-23 18:15:00 UTC |
| Updated | 2020-01-28 21:49:00 UTC |
| Description | An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185. There is a CORS misconfiguration, which reflected the Origin provided by incoming requests. This allowed JavaScript running on any domain to interact with the server APIs and perform administrative actions, without the victim's knowledge. |
Risk And Classification
Problem Types: CWE-346
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Connectwise | Control | 19.3.25270.7185 | All | All | All |
| Application | Connectwise | Control | 19.3.25270.7185 | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| ConnectWise Control MSP Security Vulnerabilities Are ‘Severe:’ Bishop Fox | MISC | www.crn.com | Third Party Advisory |
| ConnectWise Control 19.3.25270.7185 - Eight Vulnerabilities, Including Critical | MISC | know.bishopfox.com | Exploit, Third Party Advisory |
| Bishop Fox Advisories | MISC | know.bishopfox.com | Third Party Advisory |
| Validating the Bishop Fox Findings in ConnectWise Control | MISC | blog.huntresslabs.com | Exploit, Third Party Advisory |
| ConnectWise Control 'Attack Chain' Exploit: 20 Questions For Security Researcher Bishop Fox | MISC | www.crn.com | Third Party Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.