NVD Vulnerability Detail

CVE-2019-16516

Summary	An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185. There is a user enumeration vulnerability, allowing an unauthenticated attacker to determine with certainty if an account exists for a given username.
Publication Date	Jan. 24, 2020, 3:15 a.m.
Registration Date	Jan. 26, 2021, 11:39 a.m.
Last Update	Nov. 21, 2024, 1:30 p.m.

Affected software configurations

Related information, measures and tools

No	URL	タグ
1	http://packetstormsecurity.com/files/165432/ConnectWise-Control-19.2.24707-Username-Enumeration.html	Exploit Third Party Advisory VDB Entry
2	http://packetstormsecurity.com/files/165432/ConnectWise-Control-19.2.24707-Username-Enumeration.html	Exploit Third Party Advisory VDB Entry
3	https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34	Exploit Third Party Advisory
4	https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34	Exploit Third Party Advisory
5	https://know.bishopfox.com/advisories	Third Party Advisory
6	https://know.bishopfox.com/advisories	Third Party Advisory
7	https://know.bishopfox.com/advisories/connectwise-control	Exploit Third Party Advisory
8	https://know.bishopfox.com/advisories/connectwise-control	Exploit Third Party Advisory
9	https://www.crn.com/news/managed-services/connectwise-control-msp-security-vulnerabilities-are-severe-bishop-fox	Third Party Advisory
10	https://www.crn.com/news/managed-services/connectwise-control-msp-security-vulnerabilities-are-severe-bishop-fox	Third Party Advisory
11	https://www.crn.com/slide-shows/managed-services/connectwise-control-attack-chain-exploit-20-questions-for-security-researcher-bishop-fox	Third Party Advisory
12	https://www.crn.com/slide-shows/managed-services/connectwise-control-attack-chain-exploit-20-questions-for-security-researcher-bishop-fox	Third Party Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-203	セキュリティ関連の処理に対するレスポンスの違いに起因する情報漏えい	https://cwe.mitre.org/data/definitions/203.html

JVN Vulnerability Information

ConnectWise Control における情報漏えいに関する脆弱性

Title	ConnectWise Control における情報漏えいに関する脆弱性
Summary	ConnectWise Control (旧 ScreenConnect) には、情報漏えいに関する脆弱性が存在します。
Possible impacts	情報を取得される可能性があります。
Solution	ベンダ情報および参考情報を参照して適切な対策を実施してください。
Publication Date	Sept. 19, 2019, midnight
Registration Date	Feb. 10, 2020, 11:17 a.m.
Last Update	Feb. 10, 2020, 11:17 a.m.

Affected System

ConnectWise, Inc.

ConnectWise Control 19.3.25270.7185

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2019-16516	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16516
National Vulnerability Database (NVD)
2	CVE-2019-16516	https://nvd.nist.gov/vuln/detail/CVE-2019-16516

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-200	https://jvndb.jvn.jp/ja/cwe/CWE-200.html

ベンダー情報

No	Name	URL
ConnectWise
1	Find the ConnectWise Control Solution That's Right for You & Your Clients	https://www.connectwise.com/software/control

その他

No	Name	URL
関連文書
1	ConnectWise Control 19.3.25270.7185 - Eight Vulnerabilities, Including Critical	https://know.bishopfox.com/advisories/connectwise-control

Change Log

No	Changed Details	Date of change
1	[2020年02月10日] 掲載	Feb. 10, 2020, 11:17 a.m.