| Package | Affected versions | Patched versions |
|---|---|---|
| automate api | ≥ 2020, < 2020.1.53≥ 2020.2, < 2020.2.85≥ 2020.3, < 2020.3.114≥ 2020.4, < 2020.4.143≥ 2020.5, < 2020.5.178< 2019.12.337 | 2020.1.532020.2.852020.3.1142020.4.1432020.5.1782019.12.337 |
By using an Automate API in ConnectWise Automate before 2020.5.178, a remote authenticated user could execute commands and/or modifications within an individual Automate instance by triggering an SQL injection vulnerability in /LabTech/agent.aspx. This affects versions before 2019.12.337, 2020 before 2020.1.53, 2020.2 before 2020.2.85, 2020.3 before 2020.3.114, 2020.4 before 2020.4.143, and 2020.5 before 2020.5.178.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free