CVE-2019-16517
First published: Thu Jan 23 2020(Updated: )
An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185. There is a CORS misconfiguration, which reflected the Origin provided by incoming requests. This allowed JavaScript running on any domain to interact with the server APIs and perform administrative actions, without the victim's knowledge.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| ConnectWise Control | =19.3.25270.7185 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34
- https://know.bishopfox.com/advisories
- https://know.bishopfox.com/advisories/connectwise-control
- https://www.crn.com/news/managed-services/connectwise-control-msp-security-vulnerabilities-are-severe-bishop-fox
- https://www.crn.com/slide-shows/managed-services/connectwise-control-attack-chain-exploit-20-questions-for-security-researcher-bishop-fox
Frequently Asked Questions
What is the severity of CVE-2019-16517?
The severity of CVE-2019-16517 is critical with a CVSS score of 9.8.
What is CVE-2019-16517?
CVE-2019-16517 is a vulnerability in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185 that allows JavaScript running on any domain to interact with server APIs and perform administrative actions.
How does CVE-2019-16517 impact ConnectWise Control?
CVE-2019-16517 impacts ConnectWise Control by allowing unauthorized JavaScript from any domain to interact with server APIs and perform administrative actions.
Is there a fix available for CVE-2019-16517?
Yes, a fix for CVE-2019-16517 is available. It is recommended to update ConnectWise Control to a version that addresses the CORS misconfiguration vulnerability.
Where can I find more information about CVE-2019-16517?
More information about CVE-2019-16517 can be found in the following references: [link 1], [link 2], [link 3].
- collector/nvd-index
- agent/severity
- agent/weakness
- agent/references
- agent/author
- agent/type
- agent/description
- agent/event
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/connectwise
- canonical/connectwise control
- version/connectwise control/19.3.25270.7185