CVE-2017-11727

Name of the Vulnerable Software and Affected Versions ConnectWise Manage version 2017.5

Description The issue allows arbitrary client-side JavaScript code execution on victims who click on a crafted link. This involves a ContactCommon field in the services/system io/actionprocessor/Contact.rails component.

Recommendations For ConnectWise Manage version 2017.5, consider disabling the Contact.rails component temporarily until a patch is available to prevent arbitrary JavaScript code execution. Restrict access to the ContactCommon field to minimize the risk of exploitation.