CVE-2023-4400

State: Published
Severity: 6.2 Medium
Published: Sep 13, 2023
Updated: Sep 25, 2024
Reserved: Aug 17, 2023

Description

A password management vulnerability in Skyhigh Secure Web Gateway (SWG) in main releases 11.x prior to 11.2.14, 10.x prior to 10.2.25 and controlled release 12.x prior to 12.2.1, allows some authentication information stored in configuration files to be extracted through SWG REST API. This was possible due to SWG storing the password in plain text in some configuration files.

Scores

CVSS	Score	Vector	Source
3.1	6.2 Medium	CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N	trellix

Weaknesses

CWE-256 Plaintext Storage of a Password

Affected Products

Product	Versions
Skyhigh Secure Web Gateway (SWG)Skyhigh Security	11.x to before 11.2.14Affected 10.x to before 10.2.25Affected 12.x to before 12.2.1Affected

References

https://kcm.trellix.com/corporate/index?page=content&id=SB10406

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.