CRITICAL🇵🇱 Wersja polska

CVE-2022-2310

CVSS 10.0v3.1pub. 2022-07-27upd. 2024-11-21

An authentication bypass vulnerability in Skyhigh SWG in main releases 10.x prior to 10.2.12, 9.x prior to 9.2.23, 8.x prior to 8.2.28, and controlled release 11.x prior to 11.2.1 allows a remote attacker to bypass authentication into the administration User Interface. This is possible because of SWG incorrectly whitelisting authentication bypass methods and using a weak crypto password. This can lead to the attacker logging into the SWG admin interface, without valid credentials, as the super user with complete control over the SWG.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

  • Skyhighsecurity Secure Web Gateway

    APP
    Skyhighsecurity
    8.0.0 – 8.2.28 (bez)9.0.0 – 9.2.23 (bez)10.0.0 – 10.2.12 (bez)11.0.0 – 11.2.1 (bez)
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
Auth Bypass
CWE
References

Related vulnerabilities

CVE-2024-6398MEDIUM4.3ten sam produkt

An information disclosure vulnerability in SWG in versions 12.x prior to 12.2.10 and 11.x prior to 11.2.24 all...

CVE-2023-4400MEDIUM6.2ten sam produkt

A password management vulnerability in Skyhigh Secure Web Gateway (SWG) in main releases 11.x prior to 11.2.1...