CVE-2023-23126 (automate)

** DISPUTED ** Connectwise Automate 2022.11 is vulnerable to Clickjacking. The login screen can be iframed and used to manipulate users to perform unintended actions. NOTE: the vendor's position is that a Content-Security-Policy HTTP response header is present to block this attack.

actions attack block clickjacking connectwise content-security-policy cve header http login policy response screen security vendor vulnerable