What is the severity of CVE-2022-36781?

CVE-2022-36781 has a medium severity rating due to its potential for exploitation through brute force attacks.

How do I fix CVE-2022-36781?

To fix CVE-2022-36781, you should upgrade to ConnectWise ScreenConnect version 22.7 or later to ensure adequate rate-limiting controls are in place.

What versions are affected by CVE-2022-36781?

CVE-2022-36781 affects ConnectWise ScreenConnect versions 22.6 and below.

Who is impacted by CVE-2022-36781?

Organizations using ConnectWise ScreenConnect versions 22.6 and below are impacted by CVE-2022-36781.

Vulnerability/
CVE-2022-36781

medium

5.9

CWE

307

11/9/2022

16/9/2024

CVE-2022-36781: ConnectWise - ScreenConnect Session Code Bypass

Q: What type of attack does CVE-2022-36781 allow?

CVE-2022-36781 allows potential brute force attacks on custom access tokens due to inadequate security provisions.

First published: Sun Sep 11 2022(Updated: )

ConnectWise ScreenConnect versions 22.6 and below contained a flaw allowing potential brute force attacks on custom access tokens due to inadequate rate-limiting controls in the default configuration. Attackers could exploit this vulnerability to gain unauthorized access by repeatedly attempting access code combinations. ConnectWise has addressed this issue in later versions by implementing rate-limiting controls as a preventive measure against brute force attacks.

Credit: cna@cyber.gov.il cna@cyber.gov.il

Affected Software	Affected Version	How to fix
ConnectWise Manage	<22.7
ScreenConnect	<22.7

Remedy

Update to version 22.7.

Never miss a vulnerability like this again

Reference Links

https://www.gov.il/en/Departments/faq/cve_advisories

Frequently Asked Questions

What is the severity of CVE-2022-36781?
CVE-2022-36781 has a medium severity rating due to its potential for exploitation through brute force attacks.
How do I fix CVE-2022-36781?
To fix CVE-2022-36781, you should upgrade to ConnectWise ScreenConnect version 22.7 or later to ensure adequate rate-limiting controls are in place.
What versions are affected by CVE-2022-36781?
CVE-2022-36781 affects ConnectWise ScreenConnect versions 22.6 and below.
What type of attack does CVE-2022-36781 allow?
CVE-2022-36781 allows potential brute force attacks on custom access tokens due to inadequate security provisions.
Who is impacted by CVE-2022-36781?
Organizations using ConnectWise ScreenConnect versions 22.6 and below are impacted by CVE-2022-36781.

agent/type
agent/references
agent/weakness
agent/remedy
agent/severity
agent/title
agent/first-publish-date
agent/event
agent/author
collector/mitre-cve
source/MITRE
agent/last-modified-date
agent/description
agent/source
collector/nvd-index
agent/software-canonical-lookup-request
agent/tags
agent/softwarecombine
collector/nvd-api
source/NVD
agent/software-canonical-lookup
vendor/connectwise
canonical/connectwise manage
canonical/screenconnect

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.