CVE-2023-0214
Medium
Description
A cross-site scripting vulnerability in Skyhigh SWG in main releases 11.x prior to 11.2.6, 10.x prior to 10.2.17, and controlled release 12.x prior to 12.0.1 allows a remote attacker to craft SWG-specific internal requests with URL paths to any third-party website, causing arbitrary content to be injected into the response when accessed through SWG.
SeverityMedium
CVSS6.1
Exploit probability80. percentile1.9%
ProductTrellix Skyhigh Secure Web Gateway
PublishedJan 18, 2023
First seenJan 18, 2023
Weakness typeCWE-79Cross-site scripting (XSS)
How to fix
Update
- trellix skyhigh_secure_web_gateway10.2.17, 11.2.6 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| trellix skyhigh_secure_web_gateway | 10.0.0 ≤ v < 10.2.17, 11.0.0 ≤ v < 11.2.6, 12.0.0 | 10.2.17, 11.2.6 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.