PT-2017-12204
CVE-2017-11727
·
Publicado
2017-07-31
·
Atualizado
2017-08-04
Descrição por
CVSS 3.1
6.1
MédiaMétricasAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions
ConnectWise Manage version 2017.5
Description
The issue allows arbitrary client-side JavaScript code execution on victims who click on a crafted link. This involves a ContactCommon field in the services/system io/actionprocessor/Contact.rails component.
Recommendations
For ConnectWise Manage version 2017.5, consider disabling the Contact.rails component temporarily until a patch is available to prevent arbitrary JavaScript code execution. Restrict access to the ContactCommon field to minimize the risk of exploitation.
Explorabilidade
Exploit
Correção
Impactos
Fornecedores
Produtos afetados
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾