CVE-2022-1254 SWG URL redirection vulnerability
Remote attackers can redirect users to malicious sites via crafted URLs in Skyhigh SWG, bypassing security controls.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2022-1254?
CVE-2022-1254 is a medium-severity vulnerability in McAfee,LLC Secure Web Gateway, published on 20 Apr 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A URL redirection vulnerability in Skyhigh SWG in main releases 10.x prior to 10.2.9, 9.x prior to 9.2.20, 8.x prior to 8.2.27, and 7.x prior to 7.8.2.31, and controlled release 11.x prior to 11.1.3 allows a remote attacker to redirect a user to a malicious website controlled by the attacker. This is possible because SWG incorrectly creates a HTTP redirect response when a user clicks a carefully constructed URL. Following the redirect response, the new request is still filtered by the SWG policy.
Weakness: CWE-601
Which versions are affected by CVE-2022-1254?
It affects 1 product.
Products include Mcafee Web Gateway.
How do I fix CVE-2022-1254?
No fix has been published for CVE-2022-1254 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-1254 being exploited?
There is no known exploitation of CVE-2022-1254 in the wild and no public exploit code.
Other vulnerabilities in McAfee,LLC Secure Web Gateway
- CVE-2021-23885 Privilege escalation vulnerability in McAfee Web Gateway (MWG) UI
- CVE-2020-7293 Web Gateway (MWG) - Privilege Escalation vulnerability
- CVE-2019-3638 Web Gateway (MWG) - Reflected Cross Site Scripting vulnerability
- CVE-2019-3639 MWG UI: Cross-Frame Scripting vulnerability
- CVE-2020-7296 Web Gateway (MWG) - Privilege Escalation vulnerability
Sources
Also known as GHSA-2rm2-wchv-ghgw.