Lucene search

K
cve[email protected]CVE-2023-23126
HistoryFeb 01, 2023 - 2:15 p.m.

CVE-2023-23126

2023-02-0114:15:09
CWE-1021
web.nvd.nist.gov
25
connectwise automate
cve-2023-23126
clickjacking
content-security-policy
nvd

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

6.2 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

27.1%

Connectwise Automate 2022.11 is vulnerable to Clickjacking. The login screen can be iframed and used to manipulate users to perform unintended actions. NOTE: the vendor’s position is that a Content-Security-Policy HTTP response header is present to block this attack.

Affected configurations

NVD
Node
connectwiseautomateMatch2022.11

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

6.2 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

27.1%

Related for CVE-2023-23126