VYPR
← All advisories
High severity8.8NVD Advisory· Published Jun 15, 2020· Updated Jun 17, 2026

CVE-2020-14159

CVE-2020-14159

Description

By using an Automate API in ConnectWise Automate before 2020.5.178, a remote authenticated user could execute commands and/or modifications within an individual Automate instance by triggering an SQL injection vulnerability in /LabTech/agent.aspx. This affects versions before 2019.12.337, 2020 before 2020.1.53, 2020.2 before 2020.2.85, 2020.3 before 2020.3.114, 2020.4 before 2020.4.143, and 2020.5 before 2020.5.178.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

3
  • Connectwise/Automate API
    cpe:2.3:a:connectwise:automate_api:*:*:*:*:*:*:*:*
    Range: <2019.12.337
  • ConnectWise/Automatedescription
  • Connectwise/Automatellm-fuzzy
    Range: <2020.5.178, <2019.12.337, <2020.1.53, <2020.2.85, <2020.3.114, <2020.4.143

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.