CVE-2023-0214

MEDIUM

Skyhigh SWG <11.2.6-10.2.17-12.0.1 - XSS

Title source: llm

Description

A cross-site scripting vulnerability in Skyhigh SWG in main releases 11.x prior to 11.2.6, 10.x prior to 10.2.17, and controlled release 12.x prior to 12.0.1 allows a remote attacker to craft SWG-specific internal requests with URL paths to any third-party website, causing arbitrary content to be injected into the response when accessed through SWG.

Exploits (2)

exploitdb WRITEUP
by RedTeam Pentesting GmbH · textwebappsmultiple
https://www.exploit-db.com/exploits/51237
nomisec WORKING POC
by 0pts · poc
https://github.com/0pts/CVE-2023-0214

References (1)

Scores

CVSS v3 6.1
EPSS 0.0390
EPSS Percentile 88.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

CWE
CWE-79
Status published
Products (2)
trellix/skyhigh_secure_web_gateway 12.0.0
trellix/skyhigh_secure_web_gateway 10.0.0 - 10.2.17
Published Jan 18, 2023
Tracked Since Feb 18, 2026