Vulnerability Intelligence Report
CVE-2019-16517
An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185. There is a CORS misconfiguration, which reflected the Origin provided by incoming requests. This allowed JavaScript running on any domain to interact with the server APIs and perform administrative actions, without the victim's knowledge.
No Active Exploit Signals
CVSS Base Score
9.8
CRITICAL
EPSS Probability:1.33%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| connectwise | control | 19.3.25270.7185 |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
EPSS Score
1.327%
GitHub Advisory
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | MITRE Corporation · N/A · USA |
| Reserved | 2019-09-19T00:00:00 |
| Published | 2020-01-23T17:19:23 |
| Last Updated | 2024-08-05T01:17:40 |
Community Chatter & Buzz