{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2024-1709/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2024-1709/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2024-1709/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2024-1709/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2024-1709/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2024-1709"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2024-1709"
    }
  },
  "data": {
    "nuclei": true,
    "nuclei_template": "http/cves/2024/CVE-2024-1709.yaml",
    "nuclei_template_severity": "critical",
    "nuclei_template_yaml": "id: CVE-2024-1709\n\ninfo:\n  name: ConnectWise ScreenConnect 23.9.7 - Authentication Bypass\n  author: johnk3r\n  severity: critical\n  description: |\n    ConnectWise ScreenConnect 23.9.7 and prior are affected by an Authentication Bypass Using an Alternate Path or Channel vulnerability, which may allow an attacker direct access to confidential information or critical systems.\n  impact: |\n    Unauthenticated attackers can bypass authentication to access confidential information or critical systems, potentially leading to complete system compromise.\n  remediation: |\n    Update ConnectWise ScreenConnect to version 23.9.8 or later.\n  reference:\n    - https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass\n    - https://github.com/watchtowrlabs/connectwise-screenconnect_auth-bypass-add-user-poc\n    - https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8\n    - https://nvd.nist.gov/vuln/detail/CVE-2024-1709\n    - https://github.com/rapid7/metasploit-framework/pull/18870\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\n    cvss-score: 10\n    cve-id: CVE-2024-1709\n    cwe-id: CWE-288,NVD-CWE-Other\n    epss-score: 0.9998\n    epss-percentile: 0.9998\n    cpe: cpe:2.3:a:connectwise:screenconnect:*:*:*:*:*:*:*:*\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: connectwise\n    product: screenconnect\n    shodan-query: http.favicon.hash:-82958153\n    fofa-query:\n      - app=\"ScreenConnect-Remote-Support-Software\"\n      - app=\"screenconnect-remote-support-software\"\n      - icon_hash=-82958153\n    zoomeye-query: app=\"ScreenConnect Remote Management Software\"\n    hunter-query:\n      - app.name=\"ConnectWise ScreenConnect software\"\n      - app.name=\"connectwise screenconnect software\"\n  tags: cve,cve2024,screenconnect,connectwise,auth-bypass,kev,vkev,vuln\nvariables:\n  string: \"{{rand_text_alpha(10)}}\"\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/SetupWizard.aspx/{{string}}\"\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"SetupWizardPage\"\n          - \"ContentPanel SetupWizard\"\n        condition: and\n\n      - type: status\n        status:\n          - 200\n\n    extractors:\n      - type: kval\n        part: header\n        kval:\n          - Server\n# digest: 4a0a00473045022039b15717b6833c0ed41be7043d705c69c24c6f397d229d15f2277f01e1bb4a2802210093af5f950e8c46d76c4cbc1a35aa54d98cf31fa8bdefc072f93577072f5476e1:922c64590222798bb761d5b6d8e72950"
  },
  "source": "nuclei",
  "vuln_id": "cve-2024-1709"
}