CVE-2023-23130 Information disclosure in n/a

What is CVE-2023-23130?

CVE-2023-23130 is a medium-severity vulnerability in n/a, published on 1 Feb 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Connectwise Automate 2022.11 is vulnerable to Cleartext authentication. Authentication is being done via HTTP (cleartext) with SSL disabled. OTE: the vendor's position is that, by design, this is controlled by a configuration option in which a customer can choose to use HTTP (rather than HTTPS) during troubleshooting.

Weakness: CWE-319

Which versions are affected by CVE-2023-23130?

It affects 1 product.

Products include Connectwise Automate.

How do I fix CVE-2023-23130?

No fix has been published for CVE-2023-23130 yet. Limit exposure of the affected software until one is available.

Is CVE-2023-23130 being exploited?

There is no known exploitation of CVE-2023-23130 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2021-35066 XML external entity in n/a Critical 9.8
• CVE-2020-15027 Auth bypass in n/a Critical 9.8
• CVE-2025-11492 HTTP Configuration and Encryption in Transit Critical 9.6
• CVE-2026-9089 Supply chain in Automate High 8.8
• CVE-2025-11493 Self-Update Verification Mechanism Process in ConnectWise Automate High 8.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-6g7p-j2q6-fp39.