CVE-2019-16517: Critical severity connectwise vulnerability
An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185. There is a CORS misconfiguration, which reflected the Origin provided by incoming requests. This allowed JavaScript running on any domain to interact with the server APIs and perform administrative actions, without the victim's knowledge.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-16517?
The severity of CVE-2019-16517 is critical with a CVSS score of 9.8.
What is CVE-2019-16517?
CVE-2019-16517 is a vulnerability in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185 that allows JavaScript running on any domain to interact with server APIs and perform administrative actions.
How does CVE-2019-16517 impact ConnectWise Control?
CVE-2019-16517 impacts ConnectWise Control by allowing unauthorized JavaScript from any domain to interact with server APIs and perform administrative actions.
Is there a fix available for CVE-2019-16517?
Yes, a fix for CVE-2019-16517 is available. It is recommended to update ConnectWise Control to a version that addresses the CORS misconfiguration vulnerability.
Where can I find more information about CVE-2019-16517?
More information about CVE-2019-16517 can be found in the following references: [link 1], [link 2], [link 3].