ConnectWise ScreenConnect 23.9.7 and prior are affected by an authentication bypass using an alternate path or channel vulnerability, which may allow an attacker direct access to confidential information or critical systems.
Leaked credentials can then be relayed against the Exchange server to gain privileges as the victim client and to perform operations on the Exchange server on the victim’s behalf.
A complete vendor solution is available. Either the vendor has issued an official patch, or an upgrade is available.
Citrix ADC and Citrix Gateway Vulnerability: Malicious Website Redirects (CVE-2022-27509)
