CVE-2023-23130

Severity: medium (CVSS 5.9 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-02-01 · updated 2026-06-17
Weakness: CWE-319

Description

Connectwise Automate 2022.11 is vulnerable to Cleartext authentication. Authentication is being done via HTTP (cleartext) with SSL disabled. OTE: the vendor's position is that, by design, this is controlled by a configuration option in which a customer can choose to use HTTP (rather than HTTPS) during troubleshooting.

Affected products

ConnectWise Automate: 2022.11

References

https://github.com/l00neyhacker/CVE-2023-23130
https://github.com/l00neyhacker/CVE-2023-23130

Get alerted when CVE-2023-23130 or the next vulnerability affects your stack