CVE-2023-0214 XSS in Skyhigh Security SWG

2023-01-1810:49:16

CWE-79

trellix

www.cve.org

cross-site scripting

skyhigh swg

remote attacker

url paths

arbitrary content

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

0.001 Low

EPSS

Percentile

42.4%

JSON

A cross-site scripting vulnerability in Skyhigh SWG in main releases 11.x prior to 11.2.6, 10.x prior to 10.2.17, and controlled release 12.x prior to 12.0.1 allows a remote attacker to craft SWG-specific internal requests with URL paths to any third-party website, causing arbitrary content to be injected into the response when accessed through SWG.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Secure Web Gateway (SWG)",
    "vendor": "Skyhigh Security",
    "versions": [
      {
        "lessThan": "11.2.6",
        "status": "affected",
        "version": "11.x",
        "versionType": "custom"
      },
      {
        "lessThan": "10.2.17",
        "status": "affected",
        "version": "10.x",
        "versionType": "custom"
      },
      {
        "lessThan": "12.0.1",
        "status": "affected",
        "version": "12.x",
        "versionType": "custom"
      }
    ]
  }
]