Cross-Site Scripting Vulnerability in ConnectWise Manage by ConnectWise
CVE-2017-11727

6.1MEDIUM

Key Information:

Vendor

Connectwise
Status
Manage
Vendor
CVE Published:
31 July 2017

What is CVE-2017-11727?

In ConnectWise Manage version 2017.5, a vulnerability exists within the services/system_io/actionprocessor/Contact.rails component that allows attackers to execute arbitrary client-side JavaScript code. This occurs when users click on a specially crafted link, leading to potential security breaches, data exposure, and manipulation of user sessions.

References

https://becomepentester.blogspot.in/2017/07/ConnectWise-M...
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.