CVE-2024-1709

Опубликовано: 21 фев. 2024

Источник: nvd

CVSS3: 10

EPSS Критический

Описание

ConnectWise ScreenConnect 23.9.7 and prior are affected by an Authentication Bypass Using an Alternate Path or Channel

vulnerability, which may allow an attacker direct access to confidential information or

critical systems.

Ссылки

https://github.com/rapid7/metasploit-framework/pull/18870
Issue Tracking
Patch
Third Party Advisory
https://github.com/watchtowrlabs/connectwise-screenconnect_auth-bypass-add-user-poc
Exploit
Third Party Advisory
https://techcrunch.com/2024/02/21/researchers-warn-high-risk-connectwise-flaw-under-attack-is-embarrassingly-easy-to-exploit/
Press/Media Coverage
Third Party Advisory
https://www.bleepingcomputer.com/news/security/connectwise-urges-screenconnect-admins-to-patch-critical-rce-flaw/
Press/Media Coverage
Third Party Advisory
https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8
Vendor Advisory
https://www.horizon3.ai/attack-research/red-team/connectwise-screenconnect-auth-bypass-deep-dive/
Third Party Advisory
https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
Exploit
Third Party Advisory
https://www.huntress.com/blog/detection-guidance-for-connectwise-cwe-288-2
Exploit
Third Party Advisory
https://www.huntress.com/blog/vulnerability-reproduced-immediately-patch-screenconnect-23-9-8
Third Party Advisory
https://www.securityweek.com/connectwise-confirms-screenconnect-flaw-under-active-exploitation/
Press/Media Coverage
Third Party Advisory
https://github.com/rapid7/metasploit-framework/pull/18870
Issue Tracking
Patch
Third Party Advisory
https://github.com/watchtowrlabs/connectwise-screenconnect_auth-bypass-add-user-poc
Exploit
Third Party Advisory
https://techcrunch.com/2024/02/21/researchers-warn-high-risk-connectwise-flaw-under-attack-is-embarrassingly-easy-to-exploit/
Press/Media Coverage
Third Party Advisory
https://www.bleepingcomputer.com/news/security/connectwise-urges-screenconnect-admins-to-patch-critical-rce-flaw/
Press/Media Coverage
Third Party Advisory
https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8
Vendor Advisory
https://www.horizon3.ai/attack-research/red-team/connectwise-screenconnect-auth-bypass-deep-dive/
Third Party Advisory
https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
Exploit
Third Party Advisory
https://www.huntress.com/blog/detection-guidance-for-connectwise-cwe-288-2
Exploit
Third Party Advisory
https://www.huntress.com/blog/vulnerability-reproduced-immediately-patch-screenconnect-23-9-8
Third Party Advisory
https://www.securityweek.com/connectwise-confirms-screenconnect-flaw-under-active-exploitation/
Press/Media Coverage
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:connectwise:screenconnect:*:*:*:*:*:*:*:*

Версия до 23.9.8 (исключая)

EPSS

Процентиль: 100%

0.94322

Критический

10 Critical

CVSS3

Дефекты

CWE-288

NVD-CWE-Other

Связанные уязвимости

GHSA-cg3j-75xh-7fv3

CVSS3: 10

github

почти 2 года назад

ConnectWise ScreenConnect 23.9.7 and prior are affected by an Authentication Bypass Using an Alternate Path or Channel vulnerability, which may allow an attacker direct access to confidential information or critical systems.

BDU:2024-01531

CVSS3: 10

fstec

почти 2 года назад

Уязвимость программного средства организации удалённого доступа ConnectWise ScreenConnect, связанная с обходом процедуры аутентификации посредством использования альтернативного пути или канала, позволяющая нарушителю выполнить произвольный код

EPSS

Процентиль: 100%

0.94322

Критический

10 Critical

CVSS3

Дефекты

CWE-288

NVD-CWE-Other