CVE-2020-14159

By using an Automate API in ConnectWise Automate before 2020.5.178, a remote authenticated user could execute commands and/or modifications within an…

published June 15, 2020

CVSS
—
EPSS
2%
Percentile
79.9
In the wild
Unconfirmed
What it is

By using an Automate API in ConnectWise Automate before 2020.5.178, a remote authenticated user could execute commands and/or modifications within an individual Automate instance by triggering an SQL injection vulnerability in /LabTech/agent.aspx. This affects versions before 2019.12.337, 2020 before 2020.1.53, 2020.2 before 2020.2.85, 2020.3 before 2020.3.114, 2020.4 before 2020.4.143, and 2020.5 before 2020.5.178.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01932 · 79.9th percentile
Published
2020-06-15T18:21Z
EPSS history
Timeline
  • 15 JUN 18:21Z
    By using an Automate API in ConnectWise Automate before 2020.5.178, a remote authenticated user could execute commands and/or modifications within an…
    cvelistv5