PT-2023-16091 · Mcafee · Skyhigh Swg

Published 2023-01-18 · Updated 2023-01-25 · CVE-2023-0214

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Skyhigh SWG versions 10.x prior to 10.2.17 Skyhigh SWG versions 11.x prior to 11.2.6 Skyhigh SWG versions 12.x prior to 12.0.1

Description A cross-site scripting issue allows a remote attacker to craft specific internal requests with URL paths to any third-party website, causing arbitrary content to be injected into the response when accessed through Skyhigh SWG.

Recommendations For versions 10.x prior to 10.2.17, update to version 10.2.17 or later. For versions 11.x prior to 11.2.6, update to version 11.2.6 or later. For versions 12.x prior to 12.0.1, update to version 12.0.1 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-0214

Affected Products

Skyhigh Swg

References · 7

• 🔥 https://exploit-db.com/exploits/51237 · Exploit
• https://kcm.trellix.com/corporate/index?page=content&id=SB10393 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-0214 · Security Note
• https://osv.dev/vulnerability/CVE-2023-0214 · Vendor Advisory
• https://t.me/cvenotify/42271 · Telegram Post
• https://t.me/cvenotify/42834 · Telegram Post
• https://t.me/cvenotify/42266 · Telegram Post