CVE-2020-14159

By using an Automate API in ConnectWise Automate before 2020.5.178, a remote authenticated user could execute commands and/or modifications within an individual Automate instance by triggering an SQL injection vulnerability in /LabTech/agent.aspx. This affects versions before 2019.12.337, 2020...

Design/Logic Flaw

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2020-14159. Reason: This candidate is a reservation duplicate of CVE-2020-14159. Notes: All CVE users should reference CVE-2020-14159 instead of this candidate. All references and descriptions in this candidate have been removed t...

CVE-2020-14159

Affected software: ConnectWise Automate (formerly LabTech). Vulnerability: SQL injection exposed via /LabTech/agent.aspx triggered through the Automate API. Impact: remote authenticated user could execute commands and/or modify within an individual Automate instance. Root cause: improper handling...