CVE-2024-1708KEV · OVERDUECWE-22
Improper limitation of a pathname to a restricted directory (“path traversal”)
High · published February 21, 2024
Patch now
Confirmed exploited, and the score agrees
CVSS calls it high at 8.4. It is confirmed in active exploitation. It sits in the 99.9th percentile for exploit probability.
165
days past CISA
deadline
What it is
ConnectWise ScreenConnect 23.9.7 and prior are affected by path-traversal vulnerability, which may allow an attacker
the ability to execute remote code or directly impact confidential data or critical systems.
The record
Technical detail
- CVSS v3.1
- 8.4 · HIGH
- Vector
- CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
- CVSS v4.0
- Not supplied
- EPSS
- 0.95436 · 99.9th percentile
- Weakness
- CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
- Published
- 2024-02-21T15:29Z
- KEV added
- 2026-04-28 · due 2026-05-12
EPSS history
Timeline