CVE-2022-2310: falha crítica em Skyhigh Secure Web Gateway (SWG)
Skyhigh SWG Authentication bypass vulnerability
Publicada em · Atualizada em
28Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 10epss 1.2%
probabilidade de exploração
1.2%top 33% das CVEs
exploração observada
nãonenhuma fonte reporta
An authentication bypass vulnerability in Skyhigh SWG in main releases 10.x prior to 10.2.12, 9.x prior to 9.2.23, 8.x prior to 8.2.28, and controlled release 11.x prior to 11.2.1 allows a remote attacker to bypass authentication into the administration User Interface. This is possible because of SWG incorrectly whitelisting authentication bypass methods and using a weak crypto password. This can lead to the attacker logging into the SWG admin interface, without valid credentials, as the super user with complete control over the SWG.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Produtos afetados
Skyhigh Security · Skyhigh Secure Web Gateway (SWG)CVEs relacionadas — Skyhigh Secure Web Gateway (SWG)
No mesmo produto, das mais perigosas para as menos.