CVEvulnerability
CVE-2021-32582
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2021-06-17
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-89
Description
An issue was discovered in ConnectWise Automate before 2021.5. A blind SQL injection vulnerability exists in core agent inventory communication that can enable an attacker to extract database information or administrative credentials from an instance via crafted monitor status responses.
Affected configurations
• connectwise connectwise automate (< 2021.5)
Related
Weakness · CWE (1)
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness
References
- https://home.connectwise.com/securityBulletin/609a9dd75cb8450001e85369 Permissions Required, Vendor Advisory
- https://www.connectwise.com/company/trust/security-bulletins Vendor Advisory
- https://www.connectwise.com/platform/unified-management/automate Product
- https://home.connectwise.com/securityBulletin/609a9dd75cb8450001e85369 Permissions Required, Vendor Advisory
- https://www.connectwise.com/company/trust/security-bulletins Vendor Advisory
- https://www.connectwise.com/platform/unified-management/automate Product