CVE-2020-14159 - CVE House
Back to Database
Status published High CVE-2020-14159

By using an Automate API in ConnectWise Automate before 2020.5.178,...

Vulnerability Description

By using an Automate API in ConnectWise Automate before 2020.5.178, a remote authenticated user could execute commands and/or modifications within an individual Automate instance by triggering an SQL injection vulnerability in /LabTech/agent.aspx. This affects versions before 2019.12.337, 2020 before 2020.1.53, 2020.2 before 2020.2.85, 2020.3 before 2020.3.114, 2020.4 before 2020.4.143, and 2020.5 before 2020.5.178.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-14159

Credits & Attribution

No credits recorded in the NVD database.

References

More from connectwise

View All →
CVE-2021-35066
An XXE vulnerability exists in ConnectWise Automate before 2021.0.6.132....
Critical 9.8
CVE-2021-32582
An issue was discovered in ConnectWise Automate before 2021.5. A...
High 7.5
CVE-2020-15838
The Agent Update System in ConnectWise Automate before 2020.8 allows...
High 8.8
CVE-2020-15027
ConnectWise Automate through 2020.x has insufficient validation on certain authentication...
Critical 9.8
CVE-2020-15008
A SQLi exists in the probe code of all Connectwise...
High 7.5

Affected Vendor

connectwise

View all reports →

Affected Software

automate api
Vulnerable Versions:
0, 2020, 2020.2, 2020.3, 2020.4, 2020.5

Timeline

Official Publish: June 15th, 2020
Last Modified: August 4th, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.