CVE-2023-0214

Published: Jan 18, 2023Modified: Jun 17, 2026

6.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.7

Source: NVD

Description

A cross-site scripting vulnerability in Skyhigh SWG in main releases 11.x prior to 11.2.6, 10.x prior to 10.2.17, and controlled release 12.x prior to 12.0.1 allows a remote attacker to craft SWG-specific internal requests with URL paths to any third-party website, causing arbitrary content to be injected into the response when accessed through SWG.

Affected (3)

Products: Trellix: Skyhigh Secure Web Gateway

Trellix

1 product

Skyhigh Secure Web Gateway

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Trellix Skyhigh Secure Web Gateway	From 10.0.0 to 10.2.17
Trellix Skyhigh Secure Web Gateway	From 11.0.0 to 11.2.6
Trellix Skyhigh Secure Web Gateway	Version 12.0.0

Related CWEs

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (2)

https://kcm.trellix.com/corporate/index?page=content&id=SB10393

Source: trellixpsirt@trellix.com

Vendor Advisory

https://kcm.trellix.com/corporate/index?page=content&id=SB10393

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.