CVE-2020-15008
Last modified
CVE-2020-15008 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. A SQLi exists in the probe code of all Connectwise Automate versions before 2020.7 or 2019.12. A SQL Injection in the probe implementation to save data to a custom table exists due to inadequate server side validation. EPSS estimates a 0.89% chance of exploitation in the next 30 days.
Description
A SQLi exists in the probe code of all Connectwise Automate versions before 2020.7 or 2019.12. A SQL Injection in the probe implementation to save data to a custom table exists due to inadequate server side validation. As the code creates dynamic SQL for the insert statement and utilizes the user supplied table name with little validation, the table name can be modified to allow arbitrary update commands to be run. Usage of other SQL injection techniques such as timing attacks, it is possible to perform full data extraction as well. Patched in 2020.7 and in a hotfix for 2019.12.
Metrics
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Connectwise | Connectwise Automate | < 2020.7 |
| Connectwise | Connectwise Automate | 2019.12 |
References
- https://slagle.tech/2020/07/06/cve-2020-15008/Not Applicable
- https://slagle.tech/2020/07/06/cve-2020-15008/Not Applicable
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2020-15008?
How severe is CVE-2020-15008?
How do I fix CVE-2020-15008?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2020
- CVE-2020-15002OX App Suite through 7.10.3 allows SSRF via the the /ajax/me…5
- CVE-2020-15003OX App Suite through 7.10.3 allows Information Exposure beca…4.3
- CVE-2020-15004OX App Suite through 7.10.3 allows stats/diagnostic?param= X…4.8
- CVE-2020-15005In MediaWiki before 1.31.8, 1.32.x and 1.33.x before 1.33.4,…3.1
- CVE-2020-15006Bludit 3.12.0 allows stored XSS via JavaScript code in an SV…5.4
- CVE-2020-15007A buffer overflow in the M_LoadDefaults function in m_misc.c…9.8
- CVE-2020-15009AsusScreenXpertServicec.exe and ScreenXpertUpgradeServiceMan…7.8
- CVE-2020-1501A spoofing vulnerability exists when Microsoft SharePoint Se…5.4
- CVE-2020-15011GNU Mailman before 2.1.33 allows arbitrary content injection…4.3
- CVE-2020-15012A Directory Traversal issue was discovered in Sonatype Nexus…8.6
- CVE-2020-15014pramodmahato BlogCMS through 2019-12-31 has admin/changepass…8.8
- CVE-2020-15015The FileExplorer component in GleamTech FileUltimate 6.1.5.0…6.1
Are you affected by CVE-2020-15008?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST