PT-2020-14128 · Connectwise · Connectwise Automate

Jason Slagle · Published 2020-07-16 · Updated 2020-07-24 · CVE-2020-15027

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ConnectWise Automate versions prior to 2020.7 ConnectWise Automate version 2019.12 before hotfix

Description The issue is related to insufficient validation on certain authentication paths, allowing authentication bypass via a series of attempts.

Recommendations For ConnectWise Automate versions prior to 2020.7, update to version 2020.7 or later. For ConnectWise Automate version 2019.12, apply the available hotfix.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2020-15027

Affected Products

Connectwise Automate

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2020-15027 · Security Note
• https://osv.dev/vulnerability/CVE-2020-15027 · Vendor Advisory
• https://slagle.tech/2020/07/06/cve-2020-15027 · Note