Cross Origin Resource Sharing Flaw in Connectwise Control by ConnectWise

CVE-2023-23128

What is CVE-2023-23128?

Connectwise Control version 22.8.10013.8329 is susceptible to a Cross Origin Resource Sharing (CORS) vulnerability. This flaw arises from the use of Access-Control-Allow-Origin wildcarding in two of the product's endpoints, which is said to facilitate certain functionalities. Despite the vendor’s position asserting that this design does not pose a risk, the potential for unauthorized access and dataextraction in a cross-origin context raises security concerns that warrant further investigation.

References