PT-2024-37595 · Swg · Swg

Published 2024-07-15 · Updated 2024-07-19 · CVE-2024-6398

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions SWG versions 11.x prior to 11.2.24 SWG versions 12.x prior to 12.2.10

Description An information disclosure issue in SWG allows information stored in a customizable block page to be disclosed to third-party websites due to Same Origin Policy Bypass of browsers in certain scenarios. The risk is considered low because other default security policies, such as URL categorization and GTI, are typically in place to block access to uncategorized or high-risk websites. The extent of the information disclosed depends on how customers have customized their block pages.

Recommendations For SWG versions 11.x prior to 11.2.24, update to version 11.2.24 or later. For SWG versions 12.x prior to 12.2.10, update to version 12.2.10 or later.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2024-6398

Affected Products

Swg

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2024-6398 · Security Note
• https://osv.dev/vulnerability/CVE-2024-6398 · Vendor Advisory
• https://t.me/cvedetector/858 · Telegram Post
• https://t.me/cvenotify/86796 · Telegram Post
• https://thrive.trellix.com/s/article/000013694 · Note