CVE-2021-32582

Description

An issue was discovered in ConnectWise Automate before 2021.5. A blind SQL injection vulnerability exists in core agent inventory communication that can enable an attacker to extract database information or administrative credentials from an instance via crafted monitor status responses.

Weakness classification

• nvd@nist.gov: CWE-89

Primary references

• cve@mitre.org — Permissions Required, Vendor Advisory
• cve@mitre.org — Vendor Advisory
• cve@mitre.org — Product
• af854a3a-2127-422b-91ae-364da2661108 — Permissions Required, Vendor Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Vendor Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Product