{"affected":[{"affectedData":[{"product":"Skyhigh Secure Web Gateway (SWG)","vendor":"Skyhigh Security","versions":[{"lessThan":"10.2.12","status":"affected","version":"10.x","versionType":"custom"},{"lessThan":"9.2.23","status":"affected","version":"9.x","versionType":"custom"},{"lessThan":"8.2.28","status":"affected","version":"8.x","versionType":"custom"},{"lessThan":"11.2.1","status":"affected","version":"Controlled 11.x","versionType":"custom"}]}],"source":"trellixpsirt@trellix.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:skyhighsecurity:secure_web_gateway:*:*:*:*:*:*:*:*","matchCriteriaId":"73A222C2-0A68-453F-A336-AEE5FC3A2CA8","versionEndExcluding":"8.2.28","versionStartIncluding":"8.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:skyhighsecurity:secure_web_gateway:*:*:*:*:*:*:*:*","matchCriteriaId":"16F667F1-11C1-4E70-8924-A103D827FCEF","versionEndExcluding":"9.2.23","versionStartIncluding":"9.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:skyhighsecurity:secure_web_gateway:*:*:*:*:*:*:*:*","matchCriteriaId":"08DC52C1-4CDE-41B3-AFB4-9904B1D23349","versionEndExcluding":"10.2.12","versionStartIncluding":"10.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:skyhighsecurity:secure_web_gateway:*:*:*:*:*:*:*:*","matchCriteriaId":"CDD760BD-58E4-46CB-BC53-1E2FB065C23C","versionEndExcluding":"11.2.1","versionStartIncluding":"11.0.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"An authentication bypass vulnerability in Skyhigh SWG in main releases 10.x prior to 10.2.12, 9.x prior to 9.2.23, 8.x prior to 8.2.28, and controlled release 11.x prior to 11.2.1 allows a remote attacker to bypass authentication into the administration User Interface. This is possible because of SWG incorrectly whitelisting authentication bypass methods and using a weak crypto password. This can lead to the attacker logging into the SWG admin interface, without valid credentials, as the super user with complete control over the SWG."},{"lang":"es","value":"Una vulnerabilidad de omisión de autenticación en Skyhigh SWG en las versiones principales 10.x anteriores a 10.2.12, 9.x anteriores a 9.2.23, 8.x anteriores a 8.2.28 y la versión controlada 11.x anteriores a 11.2.1, permite a un atacante remoto omitir la autenticación en la Interfaz de Usuario de administración. Esto es posible debido a que el SWG ha incluido incorrectamente en su lista blanca los métodos de omisión de la autenticación y ha usado una contraseña criptográfica débil. Esto puede conllevar a que el atacante entre en la interfaz de administración del SWG, sin credenciales válidas, como super usuario con control total sobre el SWG"}],"id":"CVE-2022-2310","lastModified":"2026-06-17T04:41:40.377","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":10.0,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":6.0,"source":"trellixpsirt@trellix.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2022-07-27T10:15:08.280","references":[{"source":"trellixpsirt@trellix.com","tags":["Vendor Advisory"],"url":"https://kcm.trellix.com/corporate/index?page=content&id=SB10384&actp=null&viewlocale=en_US&showDraft=false&platinum_status=false&locale=en_US"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"url":"https://kcm.trellix.com/corporate/index?page=content&id=SB10384&actp=null&viewlocale=en_US&showDraft=false&platinum_status=false&locale=en_US"}],"sourceIdentifier":"trellixpsirt@trellix.com","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-290"}],"source":"trellixpsirt@trellix.com","type":"Secondary"},{"description":[{"lang":"en","value":"CWE-290"}],"source":"nvd@nist.gov","type":"Primary"}]}