CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2023-25719
https://notcve.org/view.php?id=CVE-2023-25719
ConnectWise Control before 22.9.10032 (formerly known as ScreenConnect) fails to validate user-supplied parameters such as the Bin/ConnectWiseControl.Client.exe h parameter. This results in reflected data and injection of malicious code into a downloaded executable. The executable can be used to execute malicious queries or as a denial-of-service vector. NOTE: this CVE Record is only about the parameters, such as the h parameter (this CVE Record is not about the separate issue of signed executable files that are supposed to have unique configurations across customers' installations). • https://cybir.com/2022/cve/hijacking-connectwise-control-and-ddos https://www.connectwise.com https://www.connectwise.com/blog/cybersecurity/the-importance-of-responsible-security-disclosures https://www.huntress.com/blog/clearing-the-air-overblown-claims-of-vulnerabilities-exploits-severity • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 1CVE-2023-23127
https://notcve.org/view.php?id=CVE-2023-23127
In Connectwise Control 22.8.10013.8329, the login page does not implement HSTS headers therefore not enforcing HTTPS. NOTE: the vendor's position is that, by design, this is controlled by a configuration option in which a customer can choose to use HTTP (rather than HTTPS) during troubleshooting. • https://github.com/l00neyhacker/CVE-2023-23127 • CWE-311: Missing Encryption of Sensitive Data •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2023-23128
https://notcve.org/view.php?id=CVE-2023-23128
Connectwise Control 22.8.10013.8329 is vulnerable to Cross Origin Resource Sharing (CORS). The vendor's position is that two endpoints have Access-Control-Allow-Origin wildcarding to support product functionality, and that there is no risk from this behavior. The vulnerability report is thus not valid. • https://github.com/l00neyhacker/CVE-2023-23128 •
CVSS: 5.9EPSS: 0%CPEs: 1EXPL: 1CVE-2023-23130
https://notcve.org/view.php?id=CVE-2023-23130
Connectwise Automate 2022.11 is vulnerable to Cleartext authentication. Authentication is being done via HTTP (cleartext) with SSL disabled. OTE: the vendor's position is that, by design, this is controlled by a configuration option in which a customer can choose to use HTTP (rather than HTTPS) during troubleshooting. • https://github.com/l00neyhacker/CVE-2023-23130 • CWE-319: Cleartext Transmission of Sensitive Information •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2023-23126
https://notcve.org/view.php?id=CVE-2023-23126
Connectwise Automate 2022.11 is vulnerable to Clickjacking. The login screen can be iframed and used to manipulate users to perform unintended actions. NOTE: the vendor's position is that a Content-Security-Policy HTTP response header is present to block this attack. • https://github.com/l00neyhacker/CVE-2023-23126 • CWE-1021: Improper Restriction of Rendered UI Layers or Frames •