{"api_version":"1","generated_at":"2026-04-23T01:11:53+00:00","cve":"CVE-2019-16517","urls":{"html":"https://cve.report/CVE-2019-16517","api":"https://cve.report/api/cve/CVE-2019-16517.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2019-16517","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2019-16517"},"summary":{"title":"CVE-2019-16517","description":"An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185. There is a CORS misconfiguration, which reflected the Origin provided by incoming requests. This allowed JavaScript running on any domain to interact with the server APIs and perform administrative actions, without the victim's knowledge.","state":"PUBLIC","assigner":"cve@mitre.org","published_at":"2020-01-23 18:15:00","updated_at":"2020-01-28 21:49:00"},"problem_types":["CWE-346"],"metrics":[],"references":[{"url":"https://www.crn.com/news/managed-services/connectwise-control-msp-security-vulnerabilities-are-severe-bishop-fox","name":"https://www.crn.com/news/managed-services/connectwise-control-msp-security-vulnerabilities-are-severe-bishop-fox","refsource":"MISC","tags":["Third Party Advisory"],"title":"ConnectWise Control MSP Security Vulnerabilities Are ‘Severe:’ Bishop Fox","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://know.bishopfox.com/advisories/connectwise-control","name":"https://know.bishopfox.com/advisories/connectwise-control","refsource":"MISC","tags":["Exploit","Third Party Advisory"],"title":"ConnectWise Control 19.3.25270.7185 - Eight Vulnerabilities, Including Critical","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://know.bishopfox.com/advisories","name":"https://know.bishopfox.com/advisories","refsource":"MISC","tags":["Third Party Advisory"],"title":"Bishop Fox Advisories","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34","name":"https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34","refsource":"MISC","tags":["Exploit","Third Party Advisory"],"title":"Validating the Bishop Fox Findings in ConnectWise Control","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.crn.com/slide-shows/managed-services/connectwise-control-attack-chain-exploit-20-questions-for-security-researcher-bishop-fox","name":"https://www.crn.com/slide-shows/managed-services/connectwise-control-attack-chain-exploit-20-questions-for-security-researcher-bishop-fox","refsource":"MISC","tags":["Third Party Advisory"],"title":"ConnectWise Control 'Attack Chain' Exploit: 20 Questions For Security Researcher Bishop Fox","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-16517","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-16517","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2019","cve_id":"16517","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"connectwise","cpe5":"control","cpe6":"19.3.25270.7185","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2019","cve_id":"16517","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"connectwise","cpe5":"control","cpe6":"19.3.25270.7185","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2019-16517","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185. There is a CORS misconfiguration, which reflected the Origin provided by incoming requests. This allowed JavaScript running on any domain to interact with the server APIs and perform administrative actions, without the victim's knowledge."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"url":"https://know.bishopfox.com/advisories","refsource":"MISC","name":"https://know.bishopfox.com/advisories"},{"refsource":"MISC","name":"https://know.bishopfox.com/advisories/connectwise-control","url":"https://know.bishopfox.com/advisories/connectwise-control"},{"refsource":"MISC","name":"https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34","url":"https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34"},{"refsource":"MISC","name":"https://www.crn.com/news/managed-services/connectwise-control-msp-security-vulnerabilities-are-severe-bishop-fox","url":"https://www.crn.com/news/managed-services/connectwise-control-msp-security-vulnerabilities-are-severe-bishop-fox"},{"refsource":"MISC","name":"https://www.crn.com/slide-shows/managed-services/connectwise-control-attack-chain-exploit-20-questions-for-security-researcher-bishop-fox","url":"https://www.crn.com/slide-shows/managed-services/connectwise-control-attack-chain-exploit-20-questions-for-security-researcher-bishop-fox"}]}},"nvd":{"publishedDate":"2020-01-23 18:15:00","lastModifiedDate":"2020-01-28 21:49:00","problem_types":["CWE-346"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL"},"exploitabilityScore":3.9,"impactScore":5.9},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL","baseScore":7.5},"severity":"HIGH","exploitabilityScore":10,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:connectwise:control:19.3.25270.7185:*:*:*:*:*:*:*","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2019","CveId":"16517","Ordinal":"156192","Title":"CVE-2019-16517","CVE":"CVE-2019-16517","Year":"2019"},"notes":[{"CveYear":"2019","CveId":"16517","Ordinal":"1","NoteData":"An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185. There is a CORS misconfiguration, which reflected the Origin provided by incoming requests. This allowed JavaScript running on any domain to interact with the server APIs and perform administrative actions, without the victim's knowledge.","Type":"Description","Title":null},{"CveYear":"2019","CveId":"16517","Ordinal":"2","NoteData":"2020-01-23","Type":"Other","Title":"Published"},{"CveYear":"2019","CveId":"16517","Ordinal":"3","NoteData":"2020-01-23","Type":"Other","Title":"Modified"}]}}}