10
CVE-2022-2310
- EPSS 1.42%
- Veröffentlicht 27.07.2022 10:15:08
- Zuletzt bearbeitet 21.11.2024 07:00:44
- Quelle trellixpsirt@trellix.com
- CVE-Watchlists
- Unerledigt
LoginAn authentication bypass vulnerability in Skyhigh SWG in main releases 10.x prior to 10.2.12, 9.x prior to 9.2.23, 8.x prior to 8.2.28, and controlled release 11.x prior to 11.2.1 allows a remote attacker to bypass authentication into the administration User Interface. This is possible because of SWG incorrectly whitelisting authentication bypass methods and using a weak crypto password. This can lead to the attacker logging into the SWG admin interface, without valid credentials, as the super user with complete control over the SWG.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Skyhighsecurity ≫ Secure Web Gateway Version >= 8.0.0 < 8.2.28
Skyhighsecurity ≫ Secure Web Gateway Version >= 9.0.0 < 9.2.23
Skyhighsecurity ≫ Secure Web Gateway Version >= 10.0.0 < 10.2.12
Skyhighsecurity ≫ Secure Web Gateway Version >= 11.0.0 < 11.2.1
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 1.42% | 0.8 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 9.8 | 3.9 | 5.9 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
|
| trellixpsirt@trellix.com | 10 | 3.9 | 6 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
|
CWE-290 Authentication Bypass by Spoofing
This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.