Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

CVE-2023-0214— XSS in Skyhigh Security SWG

CVSS 6.1 · Medium EPSS 3.90% · P88
Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2023-0214

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
XSS in Skyhigh Security SWG
Source: NVD (National Vulnerability Database)
Vulnerability Description
A cross-site scripting vulnerability in Skyhigh SWG in main releases 11.x prior to 11.2.6, 10.x prior to 10.2.17, and controlled release 12.x prior to 12.0.1 allows a remote attacker to craft SWG-specific internal requests with URL paths to any third-party website, causing arbitrary content to be injected into the response when accessed through SWG.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: NVD (National Vulnerability Database)
Vulnerability Title
McAfee Skyhigh Secure Web Gateway 跨站脚本漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
McAfee Skyhigh Secure Web Gateway（McAfee Skyhigh SWG）是美国迈克菲（McAfee）公司的一系列安全网关。 McAfee Skyhigh Secure Web Gateway 10.2.17 版本之前的 10.x 版本和 11.2.6 版本之前的 11.x 版本和 12.0.1 版本之前的 12.x 版本存在安全漏洞，该漏洞源于允许远程攻击者使用指向任何第三方网站的 URL 路径制作特定于 SWG 的内部请求，从而导致在通过 SWG 访问时将任意内容注入到
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

VendorProductAffected VersionsCPESubscribe
Skyhigh SecuritySecure Web Gateway (SWG) 11.x ~ 11.2.6 -

II. Public POCs for CVE-2023-0214

#POC DescriptionSource LinkShenlong Link
1Secure Web Gateway 10.2.11 - Cross-Site Scripting (XSS)https://github.com/0pts/CVE-2023-0214POC Details
AI-Generated POCPremium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2023-0214

请登录查看更多情报信息。

IV. Related Vulnerabilities

Same vendor: Skyhigh Security
Same weakness: CWE-79

V. Comments for CVE-2023-0214

No comments yet

Leave a comment