Strix
26.1K

CVE-2020-15008

HIGHCVSS 7.5/10EPSS 0.89%

Last modified

CVE-2020-15008 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. A SQLi exists in the probe code of all Connectwise Automate versions before 2020.7 or 2019.12. A SQL Injection in the probe implementation to save data to a custom table exists due to inadequate server side validation. EPSS estimates a 0.89% chance of exploitation in the next 30 days.

Description

A SQLi exists in the probe code of all Connectwise Automate versions before 2020.7 or 2019.12. A SQL Injection in the probe implementation to save data to a custom table exists due to inadequate server side validation. As the code creates dynamic SQL for the insert statement and utilizes the user supplied table name with little validation, the table name can be modified to allow arbitrary update commands to be run. Usage of other SQL injection techniques such as timing attacks, it is possible to perform full data extraction as well. Patched in 2020.7 and in a hotfix for 2019.12.

Metrics

CVSS 3.1
7.5/10

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Probability
0.89%

54.8th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
ConnectwiseConnectwise Automate< 2020.7
ConnectwiseConnectwise Automate2019.12

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2020-15008?
A SQLi exists in the probe code of all Connectwise Automate versions before 2020.7 or 2019.12. A SQL Injection in the probe implementation to save data to a custom table exists due to inadequate server side validation. As the code creates dynamic SQL for the insert statement and utilizes the user supplied table name with little validation, the table name can be modified to allow arbitrary update commands to be run. Usage of other SQL injection techniques such as timing attacks, it is possible to perform full data extraction as well. Patched in 2020.7 and in a hotfix for 2019.12.
How severe is CVE-2020-15008?
CVE-2020-15008 has a CVSS score of 7.5/10 (HIGH severity). The EPSS model estimates a 0.89% probability of exploitation in the next 30 days.
How do I fix CVE-2020-15008?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2020-15008?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST