ConnectWise ScreenConnect versions 22.6 and below contained a flaw allowing potential brute force attacks on custom access tokens due to inadequate rate-limiting controls in the default configuration. Attackers could exploit this vulnerability to gain unauthorized access by repeatedly attempting access code combinations. ConnectWise has addressed this issue in later versions by implementing rate-limiting controls as a preventive measure against brute force attacks.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Connectwise |
|
No data.
No data.
Advisories
| Source | ID | Title |
|---|---|---|
 EUVD |
EUVD-2022-39481 | ConnectWise ScreenConnect versions 22.6 and below contained a flaw allowing potential brute force attacks on custom access tokens due to inadequate rate-limiting controls in the default configuration. Attackers could exploit this vulnerability to gain unauthorized access by repeatedly attempting access code combinations. ConnectWise has addressed this issue in later versions by implementing rate-limiting controls as a preventive measure against brute force attacks. |
Fixes
Solution
Update to version 22.7.
Workaround
No workaround given by the vendor.
References
| Link | Providers |
|---|---|
| https://www.gov.il/en/Departments/faq/cve_advisories |
|
History
Mon, 16 Sep 2024 20:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | ConnectWise ScreenConnect versions 22.6 and below contained a flaw allowing potential brute force attacks on custom access tokens due to inadequate rate-limiting controls in the default configuration. Attackers could exploit this vulnerability to gain unauthorized access by repeatedly attempting access code combinations. ConnectWise has addressed this issue in later versions by implementing rate-limiting controls as a preventive measure against brute force attacks. | ConnectWise ScreenConnect versions 22.6 and below contained a flaw allowing potential brute force attacks on custom access tokens due to inadequate rate-limiting controls in the default configuration. Attackers could exploit this vulnerability to gain unauthorized access by repeatedly attempting access code combinations. ConnectWise has addressed this issue in later versions by implementing rate-limiting controls as a preventive measure against brute force attacks. |
MITRE
Status: PUBLISHED
Assigner: INCD
Published:
Updated: 2024-09-16T20:16:20.390Z
Reserved: 2022-07-26T00:00:00
Link: CVE-2022-36781
Vulnrichment
No data.
NVD
Status : Modified
Published: 2022-09-28T20:15:11.857
Modified: 2024-11-21T07:13:42.880
Link: CVE-2022-36781
Redhat
No data.
OpenCVE Enrichment
No data.