CVE-2019-16516
MEDIUMConnectWise Control <19.3.25270.7185 - Info Disclosure
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2019-16516. PoCs published by Luca Cuzzolin, czz.
AI-analyzed exploit summary This exploit performs username enumeration against ConnectWise Control by sending POST requests with a wordlist of usernames and checking for a specific response string ('PasswordInvalid') to determine valid users. It uses multiprocessing to parallelize the enumeration process.
Description
An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185. There is a user enumeration vulnerability, allowing an unauthenticated attacker to determine with certainty if an account exists for a given username.
Exploits (2)
This exploit performs username enumeration against ConnectWise Control by sending POST requests with a wordlist of usernames and checking for a specific response string ('PasswordInvalid') to determine valid users. It uses multiprocessing to parallelize the enumeration process.
This repository contains a Python script that performs user enumeration against ConnectWise Control (ScreenConnect) by exploiting CVE-2019-16516. The tool sends crafted POST requests to the login endpoint and checks for a specific response pattern ('PasswordInvalid') to determine if a username exists.
References (6)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N