CVE-2020-14159
High
Description
By using an Automate API in ConnectWise Automate before 2020.5.178, a remote authenticated user could execute commands and/or modifications within an individual Automate instance by triggering an SQL injection vulnerability in /LabTech/agent.aspx. This affects versions before 2019.12.337, 2020 before 2020.1.53, 2020.2 before 2020.2.85, 2020.3 before 2020.3.114, 2020.4 before 2020.4.143, and 2020.5 before 2020.5.178.
SeverityHigh
CVSS8.8
Exploit probability—
ProductConnectwise Automate Api
PublishedJun 15, 2020
First seenJun 15, 2020
How to fix
Update
- connectwise automate_api2019.12.337, 2020.1.53, 2020.2.85, 2020.3.114, 2020.4.143, 2020.5.178 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| connectwise automate_api | v < 2019.12.337, 2020 ≤ v < 2020.1.53, 2020.2 ≤ v < 2020.2.85, 2020.3 ≤ v < 2020.3.114, 2020.4 ≤ v < 2020.4.143, 2020.5 ≤ v < 2020.5.178 | 2019.12.337, 2020.1.53, 2020.2.85, 2020.3.114, 2020.4.143, 2020.5.178 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.