Local User Vulnerability in ConnectWise ScreenConnect Allows Relay Server Access
CVE-2023-47256

5.5MEDIUM

Key Information:

Vendor

Connectwise
Status
Screenconnect
Automate
Vendor
CVE Published:
1 February 2024

What is CVE-2023-47256?

ConnectWise ScreenConnect versions prior to 23.8.4 expose a significant vulnerability that permits local users to establish connections to arbitrary relay servers. This flaw stems from an implicit trust of proxy settings, thus compromising the integrity of the application and allowing unauthorized access to sensitive relay servers. Users of ScreenConnect should ensure their installations are updated to mitigate potential exploit risks.

References

https://www.connectwise.com/company/trust/security-bullet...
https://web.archive.org/web/20240208140218/https://gotham...

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.