CVE-2023-23130

🔶 medium

Summary

Connectwise Automate 2022.11 is vulnerable to Cleartext authentication. Authentication is being done via HTTP (cleartext) with SSL disabled. OTE: the vendor's position is that, by design, this is controlled by a configuration option in which a customer can choose to use HTTP (rather than HTTPS) during troubleshooting.

CVSS Score

5.9

Medium

EPSS Score

0.2

Exploit Probability

Published Date

2023-02-01

First Seen: 2026-01-05

📊 Relative Risk Intelligence

This CVE is Lower Risk - more severe than 32.2% of all 360,673 vulnerabilities in our database.

#244,679

Below average severity

Severity Percentile

🎯 CISA SSVC Assessment Updated: Apr 22, 2024

🔍 Exploitation Status

None

No known exploits

⚙️ Automatable

Requires human interaction

💥 Technical Impact

Partial

Limited system impact

SSVC data provided by CISA

Last Modified 2024-11-21

Source NVD 🔗

CVSS Vector 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE IDs (Weakness Types)

CWE-319

📦 Affected Products 1

Vendor	Product	Status	Affected Versions
connectwise	automate	Affected	v2022.11

🔗 References 1

https://github.com/l00neyhacker/CVE-2023-23130

Third Party Advisory

🔗 Related CVEs 6

CVE ID	Severity	CVSS	EPSS	Summary	Published
CVE-2026-9089	⚠️ high	8.8	0.3	The ConnectWise Automate™ Agent does not fully verify the authenticity of components obtained during plugin loading an...	2026-05-21
CVE-2025-11492	⛔ critical	9.6	0.0	In the ConnectWise Automate Agent, communications could be configured to use HTTP instead of HTTPS. In such cases, an on...	2025-10-16
CVE-2025-11493	⚠️ high	8.8	0.0	The ConnectWise Automate Agent does not fully verify the authenticity of files downloaded from the server, such as updat...	2025-10-16
CVE-2023-47256	🔶 medium	5.5	0.1	ConnectWise ScreenConnect through 23.8.4 allows local users to connect to arbitrary relay servers via implicit trust of ...	2024-02-01
CVE-2023-47257	⚠️ high	8.1	5.0	ConnectWise ScreenConnect through 23.8.4 allows man-in-the-middle attackers to achieve remote code execution via crafted...	2024-02-01
CVE-2023-23126	🔶 medium	6.1	0.3	Connectwise Automate 2022.11 is vulnerable to Clickjacking. The login screen can be iframed and used to manipulate users...	2023-02-01

These CVEs affect the same products