Lucene search

[email protected]CVE-2020-14159

HistoryJun 15, 2020 - 7:15 p.m.

CVE-2020-14159

2020-06-1519:15:10

CWE-89

[email protected]

web.nvd.nist.gov

cve-2020-14159

sql injection

connectwise automate

remote code execution

nvd

6.5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8.7 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

43.0%

JSON

By using an Automate API in ConnectWise Automate before 2020.5.178, a remote authenticated user could execute commands and/or modifications within an individual Automate instance by triggering an SQL injection vulnerability in /LabTech/agent.aspx. This affects versions before 2019.12.337, 2020 before 2020.1.53, 2020.2 before 2020.2.85, 2020.3 before 2020.3.114, 2020.4 before 2020.4.143, and 2020.5 before 2020.5.178.

Affected configurations

NVD

Node

connectwiseautomate_apiRange<2019.12.337

connectwiseautomate_apiRange2020–2020.1.53

connectwiseautomate_apiRange2020.2–2020.2.85

connectwiseautomate_apiRange2020.3–2020.3.114

connectwiseautomate_apiRange2020.4–2020.4.143

connectwiseautomate_apiRange2020.5–2020.5.178

CPENameOperatorVersion
connectwise:automate_apiconnectwise automate apilt2019.12.337
connectwise:automate_apiconnectwise automate apilt2020.1.53
connectwise:automate_apiconnectwise automate apilt2020.2.85
connectwise:automate_apiconnectwise automate apilt2020.3.114
connectwise:automate_apiconnectwise automate apilt2020.4.143
connectwise:automate_apiconnectwise automate apilt2020.5.178

CPE	Name	Operator	Version
connectwise:automate_api	connectwise automate api	lt	2019.12.337
connectwise:automate_api	connectwise automate api	lt	2020.1.53
connectwise:automate_api	connectwise automate api	lt	2020.2.85
connectwise:automate_api	connectwise automate api	lt	2020.3.114
connectwise:automate_api	connectwise automate api	lt	2020.4.143
connectwise:automate_api	connectwise automate api	lt	2020.5.178

References

www.connectwise.com/company/trust#tab1

6.5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8.7 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

43.0%

JSON

Related for CVE-2020-14159

nvd2 prion2 cvelist1 cve1