CVE-2023-4400 Information disclosure in Skyhigh Secure Web Gateway (SWG)
Attackers can extract plaintext authentication credentials from configuration files via the REST API, potentially bypassing security controls.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2023-4400?
CVE-2023-4400 is a medium-severity vulnerability in Skyhigh Secure Web Gateway (SWG) , published on 13 Sep 2023. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
A password management vulnerability in Skyhigh Secure Web Gateway (SWG) in main releases 11.x prior to 11.2.14, 10.x prior to 10.2.25 and controlled release 12.x prior to 12.2.1, allows some authentication information stored in configuration files to be extracted through SWG REST API. This was possible due to SWG storing the password in plain text in some configuration files.
Which versions are affected by CVE-2023-4400?
It affects 1 product.
Products include Skyhighsecurity Secure Web Gateway.
How do I fix CVE-2023-4400?
No fix has been published for CVE-2023-4400 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-4400 being exploited?
There is no known exploitation of CVE-2023-4400 in the wild and no public exploit code.
Other vulnerabilities in Skyhigh Secure Web Gateway (SWG)
Sources
Also known as GHSA-qggp-c2rq-6x65.