Vulnerability · Published Jan 18, 2023 · Assigned by trellix
CVE-2023-0214XSS in Skyhigh Security SWG
Medium 6.1
In plain English
A medium-severity cross-site scripting in Secure Web Gateway (SWG) from Skyhigh Security. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.9% (higher than 80% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Official description
A cross-site scripting vulnerability in Skyhigh SWG in main releases 11.x prior to 11.2.6, 10.x prior to 10.2.17, and controlled release 12.x prior to 12.0.1 allows a remote attacker to craft SWG-specific internal requests with URL paths to any third-party website, causing arbitrary content to be injected into the response when accessed through SWG.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Skyhigh Security | Secure Web Gateway (SWG) | 11.x – before 11.2.610.x – before 10.2.1712.x – before 12.0.1 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N