Vulnerabilities

TI-2017-08684 CVE-2017-11727 · GHSA-4vjw-6g94-68x5

services/system_io/actionprocessor/Contact.rails in ConnectWise Manage 2017.5 allows…

LOW 29

services/system_io/actionprocessor/Contact.rails in ConnectWise Manage 2017.5 allows arbitrary client-side JavaScript code execution (involving a ContactCommon field) on victims who click on a crafted link, aka XSS.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.01064 Published 2017-07-31 No fix listed CWE-79

TI-2017-08683 CVE-2017-11726 · GHSA-f9qr-7q44-4mjx

services/system_io/actionprocessor/System.rails in ConnectWise Manage 2017.5 is…

LOW 39

services/system_io/actionprocessor/System.rails in ConnectWise Manage 2017.5 is vulnerable to Cross-Site Request Forgery (CSRF), as demonstrated by changing an e-mail address setting.

CVSS 3.0HIGH 8.8 Network No auth User interaction EPSS 0.00477 Published 2017-07-31 No fix listed CWE-352

Vulnerabilities

Filters

services/system_io/actionprocessor/Contact.rails in ConnectWise Manage 2017.5 allows…

services/system_io/actionprocessor/System.rails in ConnectWise Manage 2017.5 is…