CVE-2019-16517 - CVE House
Back to Database
Status published Critical CVE-2019-16517

An issue was discovered in ConnectWise Control (formerly known as...

Vulnerability Description

An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185. There is a CORS misconfiguration, which reflected the Origin provided by incoming requests. This allowed JavaScript running on any domain to interact with the server APIs and perform administrative actions, without the victim's knowledge.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-16517

Credits & Attribution

No credits recorded in the NVD database.

References

More from connectwise

View All →
CVE-2021-35066
An XXE vulnerability exists in ConnectWise Automate before 2021.0.6.132....
Critical 9.8
CVE-2021-32582
An issue was discovered in ConnectWise Automate before 2021.5. A...
High 7.5
CVE-2020-15838
The Agent Update System in ConnectWise Automate before 2020.8 allows...
High 8.8
CVE-2020-15027
ConnectWise Automate through 2020.x has insufficient validation on certain authentication...
Critical 9.8
CVE-2020-15008
A SQLi exists in the probe code of all Connectwise...
High 7.5

Affected Vendor

connectwise

View all reports →

Affected Software

control
Vulnerable Versions:
19.3.25270.7185

Timeline

Official Publish: January 23rd, 2020
Last Modified: August 5th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.