PT-2017-12203
CVE-2017-11726
·
تاريخ النشر
2017-07-31
·
تاريخ التحديث
2017-08-04
الوصف من
CVSS 3.1
8.8
عاليةالمقاييسAV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
ConnectWise Manage version 2017.5
Description
The issue concerns a Cross-Site Request Forgery (CSRF) vulnerability. It allows for the modification of settings, such as changing an e-mail address, as demonstrated in the
services/system io/actionprocessor/System.rails component.Recommendations
For ConnectWise Manage version 2017.5, consider implementing CSRF protection mechanisms to prevent unauthorized changes to settings. As a temporary workaround, restrict access to the
services/system io/actionprocessor/System.rails component to minimize the risk of exploitation. وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾