2 lines
3.7 KiB
JSON
2 lines
3.7 KiB
JSON
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Secure Web Gateway (SWG)","vendor":"Skyhigh Security","versions":[{"lessThan":"11.2.6","status":"affected","version":"11.x","versionType":"custom"},{"lessThan":"10.2.17","status":"affected","version":"10.x","versionType":"custom"},{"lessThan":"12.0.1","status":"affected","version":"12.x","versionType":"custom"}]}],"source":"trellixpsirt@trellix.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:trellix:skyhigh_secure_web_gateway:*:*:*:*:*:*:*:*","matchCriteriaId":"6FB99F4A-1462-4F6A-961B-03A95E467A3A","versionEndExcluding":"10.2.17","versionStartIncluding":"10.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:trellix:skyhigh_secure_web_gateway:*:*:*:*:*:*:*:*","matchCriteriaId":"4488FDBC-6521-42BE-AC38-7B8030835525","versionEndExcluding":"11.2.6","versionStartIncluding":"11.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:trellix:skyhigh_secure_web_gateway:12.0.0:*:*:*:*:*:*:*","matchCriteriaId":"52ABF6E4-6DF0-4C89-8E27-68E62F720594","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"A cross-site scripting vulnerability in Skyhigh SWG in main releases 11.x prior to 11.2.6, 10.x prior to 10.2.17, and controlled release 12.x prior to 12.0.1 allows a remote attacker to craft SWG-specific internal requests with URL paths to any third-party website, causing arbitrary content to be injected into the response when accessed through SWG.\n\n"},{"lang":"es","value":"Una vulnerabilidad de cross site scripting en Skyhigh SWG en las versiones principales desde la 11.x a la 11.2.6, 10.x a la 10.2.17 y la versión controlada 12.x a la 12.0.1 permite a un atacante remoto crear solicitudes internas SWG con rutas URL a cualquier sitio web de terceros, lo que provoca que se inyecte contenido arbitrario en la respuesta cuando se accede a través de SWG."}],"id":"CVE-2023-0214","lastModified":"2026-06-17T05:25:02.443","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.7,"source":"trellixpsirt@trellix.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.7,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2023-0214","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2025-04-02T16:16:05.514484Z","version":"2.0.3"}}]},"published":"2023-01-18T11:15:10.450","references":[{"source":"trellixpsirt@trellix.com","tags":["Vendor Advisory"],"url":"https://kcm.trellix.com/corporate/index?page=content&id=SB10393"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"url":"https://kcm.trellix.com/corporate/index?page=content&id=SB10393"}],"sourceIdentifier":"trellixpsirt@trellix.com","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"trellixpsirt@trellix.com","type":"Secondary"},{"description":[{"lang":"en","value":"CWE-79"}],"source":"nvd@nist.gov","type":"Primary"}]}
|