CVE-2020-14159

ALTO 8.8CVE-2020-14159 · Published 15/06/2020 · updated 17/06/2026

En resumen

CVE-2020-14159 es una vulnerabilidad ALTO (CVSS 8.8) que afecta a automate api (connectwise).
Probabilidad de explotación en los próximos 30 días (EPSS): 1.9%, mayor que el 80.0% de las vulnerabilidades.
Solución: actualizar a 2020.1.53, 2020.2.85, 2020.3.114, 2020.4.143 o posterior.

Package	Affected versions	Patched versions
automate api connectwise	`≥ 2020, < 2020.1.53≥ 2020.2, < 2020.2.85≥ 2020.3, < 2020.3.114≥ 2020.4, < 2020.4.143≥ 2020.5, < 2020.5.178< 2019.12.337`	`2020.1.532020.2.852020.3.1142020.4.1432020.5.1782019.12.337`

Description

By using an Automate API in ConnectWise Automate before 2020.5.178, a remote authenticated user could execute commands and/or modifications within an individual Automate instance by triggering an SQL injection vulnerability in /LabTech/agent.aspx. This affects versions before 2019.12.337, 2020 before 2020.1.53, 2020.2 before 2020.2.85, 2020.3 before 2020.3.114, 2020.4 before 2020.4.143, and 2020.5 before 2020.5.178.

References

connectwise.com/company/trust · Vendor Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free