MEDIUM🇵🇱 Wersja polska

CVE-2023-4400

CVSS 6.2v3.1pub. 2023-09-13upd. 2024-11-21

A password management vulnerability in Skyhigh Secure Web Gateway (SWG) in main releases 11.x prior to 11.2.14, 10.x prior to 10.2.25 and controlled release 12.x prior to 12.2.1, allows some authentication information stored in configuration files to be extracted through SWG REST API. This was possible due to SWG storing the password in plain text in some configuration files.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N

  • Skyhighsecurity Secure Web Gateway

    APP
    Skyhighsecurity
    10.0.0 – 10.2.25 (bez)11.0.0 – 11.2.14 (bez)12.0.0 – 12.2.1 (bez)
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2022-2310CRITICAL10.0ten sam produkt

An authentication bypass vulnerability in Skyhigh SWG in main releases 10.x prior to 10.2.12, 9.x prior to 9.2...

CVE-2024-6398MEDIUM4.3ten sam produkt

An information disclosure vulnerability in SWG in versions 12.x prior to 12.2.10 and 11.x prior to 11.2.24 all...