Read the docs
TI-2020-11800 Aliases CVE-2020-15008GHSA-cg9h-vhcr-m9qp

A SQLi exists in the probe code of all Connectwise Automate versions before 2020.7 or…

Priority LOW 35CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
High
Impact type
SQL injection
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-89.

Summary

A SQLi exists in the probe code of all Connectwise Automate versions before 2020.7 or 2019.12. A SQL Injection in the probe implementation to save data to a custom table exists due to inadequate server side validation. As the code creates dynamic SQL for the insert statement and utilizes the user supplied table name with little validation, the table name can be modified to allow arbitrary update commands to be run. Usage of other SQL injection techniques such as timing attacks, it is possible to perform full data extraction as well. Patched in 2020.7 and in a hotfix for 2019.12.

Why it matters now

EPSS 0.0089 59th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:connectwise:connectwise_automate:*:*:*:*:*:*:*:*before 2020.7VulnerableConnectWise
cpe:2.3:a:connectwise:connectwise_automate:2019.12:*:*:*:*:*:*:*2019.12VulnerableConnectWise
  • cpe:2.3:a:connectwise:connectwise_automate:*:*:*:*:*:*:*:* Versions before 2020.7 Vulnerable ·ConnectWise
  • cpe:2.3:a:connectwise:connectwise_automate:2019.12:*:*:*:*:*:*:* Versions 2019.12 Vulnerable ·ConnectWise

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-15008
  2. 2026-10-03 Alias added: GHSA-cg9h-vhcr-m9qp

References

Other 1

  • TI-2021-12254 An issue was discovered in ConnectWise Automate before 2021.5. CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences