CVE-2020-14159: SQL Injection
By using an Automate API in ConnectWise Automate before 2020.5.178, a remote authenticated user could execute commands and/or modifications within an individual Automate instance by triggering an SQL injection vulnerability in /LabTech/agent.aspx. This affects versions before 2019.12.337, 2020 before 2020.1.53, 2020.2 before 2020.2.85, 2020.3 before 2020.3.114, 2020.4 before 2020.4.143, and 2020.5 before 2020.5.178.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2020-14159?
CVE-2020-14159 has a severity rating that is classified as critical due to the potential for unauthorized command execution via SQL injection.
How do I fix CVE-2020-14159?
To fix CVE-2020-14159, upgrade to ConnectWise Automate API version 2020.5.178 or later, or to any version above 2019.12.337.
What is affected by CVE-2020-14159?
CVE-2020-14159 affects ConnectWise Automate API versions before 2019.12.337 and all versions of the API released up until 2020.5.178.
Can CVE-2020-14159 be exploited remotely?
Yes, CVE-2020-14159 can be exploited remotely by an authenticated user to execute unauthorized commands within the affected Automate instance.
What are the consequences of CVE-2020-14159 exploitation?
Exploitation of CVE-2020-14159 could allow an attacker to perform unauthorized modifications and potentially take control of the affected system.