CVE-2022-36781

MEDIUM Year: 2022
CVSS v3 Score
5.3
Medium
Weakness Type
CWE-307
View all →

Vulnerability Description

ConnectWise ScreenConnect versions 22.6 and below contained a flaw allowing potential brute force attacks on custom access tokens due to inadequate rate-limiting controls in the default configuration. Attackers could exploit this vulnerability to gain unauthorized access by repeatedly attempting access code combinations. ConnectWise has addressed this issue in later versions by implementing rate-limiting controls as a preventive measure against brute force attacks.

Related Vulnerabilities

CVE-2017-10604

MEDIUM
CVSS:5.3(Medium)

When the device is configured to perform account lockout with a defined period of time, any unauthenticated user attempting to log in as root with an incorrect password can trigger a lockout of the ro...

CWE-3072017

CVE-2018-16703

MEDIUM
CVSS:5.3(Medium)

A vulnerability in the Gleez CMS 1.2.0 login page could allow an unauthenticated, remote attacker to perform multiple user enumerations, which can further help an attacker to perform login attempts in...

CWE-3072018

CVE-2019-0039

MEDIUM
CVSS:5.3(Medium)

If REST API is enabled, the Junos OS login credentials are vulnerable to brute force attacks. The high default connection limit of the REST API may allow an attacker to brute-force passwords using adv...

CWE-3072019

CVE-2019-1126

MEDIUM
CVSS:5.3(Medium)

A security feature bypass vulnerability exists in Active Directory Federation Services (ADFS) which could allow an attacker to bypass the extranet lockout policy.To exploit this vulnerability, an atta...

CWE-3072019

CVE-2020-1616

MEDIUM
CVSS:5.3(Medium)

Due to insufficient server-side login attempt limit enforcement, a vulnerability in the SSH login service of Juniper Networks Juniper Advanced Threat Prevention (JATP) Series and Virtual JATP (vJATP) ...

CWE-3072020

CVE-2020-4232

MEDIUM
CVSS:5.3(Medium)

IBM Security Identity Governance and Intelligence 5.2.6 could allow an attacker to enumerate usernames to find valid login credentials which could be used to attempt further attacks against the system...

CWE-3072020