CVSS: 5.9EPSS: 0%CPEs: 1EXPL: 1CVE-2023-23130
https://notcve.org/view.php?id=CVE-2023-23130
Connectwise Automate 2022.11 is vulnerable to Cleartext authentication. Authentication is being done via HTTP (cleartext) with SSL disabled. OTE: the vendor's position is that, by design, this is controlled by a configuration option in which a customer can choose to use HTTP (rather than HTTPS) during troubleshooting. • https://github.com/l00neyhacker/CVE-2023-23130 • CWE-319: Cleartext Transmission of Sensitive Information •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2023-23126
https://notcve.org/view.php?id=CVE-2023-23126
Connectwise Automate 2022.11 is vulnerable to Clickjacking. The login screen can be iframed and used to manipulate users to perform unintended actions. NOTE: the vendor's position is that a Content-Security-Policy HTTP response header is present to block this attack. • https://github.com/l00neyhacker/CVE-2023-23126 • CWE-1021: Improper Restriction of Rendered UI Layers or Frames •