CVE-2022-2310
10 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
9.4 High
AI Score
Confidence
High
0.004 Low
EPSS
Percentile
72.3%
An authentication bypass vulnerability in Skyhigh SWG in main releases 10.x prior to 10.2.12, 9.x prior to 9.2.23, 8.x prior to 8.2.28, and controlled release 11.x prior to 11.2.1 allows a remote attacker to bypass authentication into the administration User Interface. This is possible because of SWG incorrectly whitelisting authentication bypass methods and using a weak crypto password. This can lead to the attacker logging into the SWG admin interface, without valid credentials, as the super user with complete control over the SWG.
Affected configurations
CNA Affected
[
{
"product": "Skyhigh Secure Web Gateway (SWG)",
"vendor": "Skyhigh Security",
"versions": [
{
"lessThan": "10.2.12",
"status": "affected",
"version": "10.x",
"versionType": "custom"
},
{
"lessThan": "9.2.23",
"status": "affected",
"version": "9.x",
"versionType": "custom"
},
{
"lessThan": "8.2.28",
"status": "affected",
"version": "8.x",
"versionType": "custom"
},
{
"lessThan": "11.2.1",
"status": "affected",
"version": "Controlled 11.x",
"versionType": "custom"
}
]
}
]Social References
More
Related
10 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
9.4 High
AI Score
Confidence
High
0.004 Low
EPSS
Percentile
72.3%