SQL Injection Vulnerability in ConnectWise Automate Affects Multiple Versions
CVE-2020-14159

8.8HIGH

Key Information:

Vendor

Connectwise
Status
Automate Api
Vendor
CVE Published:
15 June 2020

What is CVE-2020-14159?

A remote authenticated user can exploit an SQL injection vulnerability in ConnectWise Automate's Automate API before version 2020.5.178. This vulnerability allows the attacker to execute arbitrary commands and make unauthorized modifications within an Automate instance via the vulnerable endpoint at /LabTech/agent.aspx. Several versions are affected, highlighting the need for prompt updates to mitigate potential risks and protect sensitive data.

References

https://www.connectwise.com/company/trust#tab1
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.