PT-2020-13900 · Connectwise · Connectwise Automate

Published 2020-06-15 · Updated 2020-06-24 · CVE-2020-14159

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ConnectWise Automate versions prior to 2019.12.337 ConnectWise Automate versions 2020 before 2020.1.53 ConnectWise Automate versions 2020.2 before 2020.2.85 ConnectWise Automate versions 2020.3 before 2020.3.114 ConnectWise Automate versions 2020.4 before 2020.4.143 ConnectWise Automate versions 2020.5 before 2020.5.178

Description A remote authenticated user could execute commands and/or modifications within an individual Automate instance by triggering an SQL injection vulnerability in "/LabTech/agent.aspx" using an Automate API.

Recommendations For versions prior to 2019.12.337, update to version 2019.12.337 or later. For versions 2020 before 2020.1.53, update to version 2020.1.53 or later. For versions 2020.2 before 2020.2.85, update to version 2020.2.85 or later. For versions 2020.3 before 2020.3.114, update to version 2020.3.114 or later. For versions 2020.4 before 2020.4.143, update to version 2020.4.143 or later. For versions 2020.5 before 2020.5.178, update to version 2020.5.178 or later.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2020-14159

Affected Products

Connectwise Automate

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2020-14159 · Security Note
• https://connectwise.com/company/trust#tab1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-14159 · Vendor Advisory
• https://t.me/cvenotify/4388 · Telegram Post