CVE-2020-15008: SQL Injection
A SQLi exists in the probe code of all Connectwise Automate versions before 2020.7 or 2019.12. A SQL Injection in the probe implementation to save data to a custom table exists due to inadequate server side validation. As the code creates dynamic SQL for the insert statement and utilizes the user supplied table name with little validation, the table name can be modified to allow arbitrary update commands to be run. Usage of other SQL injection techniques such as timing attacks, it is possible to perform full data extraction as well. Patched in 2020.7 and in a hotfix for 2019.12.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2020-15008?
CVE-2020-15008 is classified as a high severity vulnerability due to its potential for SQL Injection.
How do I fix CVE-2020-15008?
To mitigate CVE-2020-15008, ensure that your Connectwise Automate is updated to version 2020.7 or 2019.12 or later.
What versions of Connectwise Automate are affected by CVE-2020-15008?
CVE-2020-15008 affects all Connectwise Automate versions prior to 2020.7 and version 2019.12.
What type of vulnerability is CVE-2020-15008?
CVE-2020-15008 is a SQL Injection vulnerability found in the probe code of Connectwise Automate.
What is the cause of the vulnerability in CVE-2020-15008?
The cause of CVE-2020-15008 is inadequate server-side validation leading to dynamic SQL creation for insert statements.