CVE-2023-0214

🗓️ 18 Jan 2023 10:49:16Reported by trellixType

cve🔗 web.nvd.nist.gov👁 46 Views🌐 WEB

A cross-site scripting vulnerability in Skyhigh SWG in main releases 11.x prior to 11.2.6, 10.x prior to 10.2.17, and controlled release 12.x prior to 12.0.1 allows a remote attacker to craft SWG-specific internal requests with URL paths to any third-party website, causing arbitrary content to be injected into the response when accessed through SWG

Reporter	Title	Published	Views	Family All 13
0day.today	Secure Web Gateway 10.2.11 Cross Site Scripting Vulnerability	26 Jan 202300:00	–	zdt
0day.today	Secure Web Gateway 10.2.11 - Cross-Site Scripting Vulnerability	5 Apr 202300:00	–	zdt
Circl	CVE-2023-0214	3 Apr 202518:35	–	circl
CNNVD	McAfee Skyhigh Secure Web Gateway 跨站脚本漏洞	18 Jan 202300:00	–	cnnvd
Cvelist	CVE-2023-0214 XSS in Skyhigh Security SWG	18 Jan 202310:49	–	cvelist
Exploit DB	Secure Web Gateway 10.2.11 - Cross-Site Scripting (XSS)	5 Apr 202300:00	–	exploitdb
EUVD	EUVD-2023-12303	3 Oct 202520:07	–	euvd
NVD	CVE-2023-0214	18 Jan 202311:15	–	nvd
OSV	CVE-2023-0214	18 Jan 202311:15	–	osv
Packet Storm	Secure Web Gateway 10.2.11 Cross Site Scripting	26 Jan 202300:00	–	packetstorm

NVD

Node

trellix skyhigh_secure_web_gatewayRange10.0.0–10.2.17

trellix skyhigh_secure_web_gatewayRange11.0.0–11.2.6

trellix skyhigh_secure_web_gatewayMatch12.0.0

[
  {
    "defaultStatus": "unaffected",
    "product": "Secure Web Gateway (SWG)",
    "vendor": "Skyhigh Security",
    "versions": [
      {
        "lessThan": "11.2.6",
        "status": "affected",
        "version": "11.x",
        "versionType": "custom"
      },
      {
        "lessThan": "10.2.17",
        "status": "affected",
        "version": "10.x",
        "versionType": "custom"
      },
      {
        "lessThan": "12.0.1",
        "status": "affected",
        "version": "12.x",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
kcm	www.kcm.trellix.com/corporate/index

Parameter	Position	Path	Description	CWE
p	query param	mwg-internal/de5fs23hu73ds/plugin	Cross-site scripting via SWG internal plugin SetLoginToken allowing arbitrary headers/body by injecting p parameter	CWE-79
v	query param	mwg-internal/de5fs23hu73ds/plugin	Cross-site scripting via SWG internal plugin SetLoginToken allowing arbitrary headers/body by injecting p parameter	CWE-79
c	query param	mwg-internal/de5fs23hu73ds/plugin	Cross-site scripting via SWG internal plugin SetLoginToken allowing arbitrary headers/body by injecting p parameter	CWE-79

17 Jun 2026 05:25Current

6Medium risk

Vulners AI Score6

CVSS 3.16.1

EPSS0.0189

SSVC

CWE-79