Filtered by vendor Connectwise Subscriptions
Filtered by product Connectwise Subscriptions
Total 2 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2023-23128 1 Connectwise 1 Connectwise 2024-11-21 6.1 Medium
Connectwise Control 22.8.10013.8329 is vulnerable to Cross Origin Resource Sharing (CORS). The vendor's position is that two endpoints have Access-Control-Allow-Origin wildcarding to support product functionality, and that there is no risk from this behavior. The vulnerability report is thus not valid.
CVE-2023-23127 1 Connectwise 1 Connectwise 2024-11-21 5.3 Medium
In Connectwise Control 22.8.10013.8329, the login page does not implement HSTS headers therefore not enforcing HTTPS. NOTE: the vendor's position is that, by design, this is controlled by a configuration option in which a customer can choose to use HTTP (rather than HTTPS) during troubleshooting.