CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 1CVE-2023-23128
https://notcve.org/view.php?id=CVE-2023-23128
01 Feb 2023 — Connectwise Control 22.8.10013.8329 is vulnerable to Cross Origin Resource Sharing (CORS). The vendor's position is that two endpoints have Access-Control-Allow-Origin wildcarding to support product functionality, and that there is no risk from this behavior. The vulnerability report is thus not valid. • https://github.com/l00neyhacker/CVE-2023-23128 • CWE-942: Permissive Cross-domain Policy with Untrusted Domains •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 1CVE-2023-23127
https://notcve.org/view.php?id=CVE-2023-23127
01 Feb 2023 — In Connectwise Control 22.8.10013.8329, the login page does not implement HSTS headers therefore not enforcing HTTPS. NOTE: the vendor's position is that, by design, this is controlled by a configuration option in which a customer can choose to use HTTP (rather than HTTPS) during troubleshooting. • https://github.com/l00neyhacker/CVE-2023-23127 • CWE-311: Missing Encryption of Sensitive Data •