Vulnerability Description
An authentication bypass vulnerability in Skyhigh SWG in main releases 10.x prior to 10.2.12, 9.x prior to 9.2.23, 8.x prior to 8.2.28, and controlled release 11.x prior to 11.2.1 allows a remote attacker to bypass authentication into the administration User Interface. This is possible because of SWG incorrectly whitelisting authentication bypass methods and using a weak crypto password. This can lead to the attacker logging into the SWG admin interface, without valid credentials, as the super user with complete control over the SWG.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Skyhighsecurity | Secure Web Gateway | >= 8.0.0, < 8.2.28 |
Related Weaknesses (CWE)
References
- https://kcm.trellix.com/corporate/index?page=content&id=SB10384&actp=null&viewloVendor Advisory
- https://kcm.trellix.com/corporate/index?page=content&id=SB10384&actp=null&viewloVendor Advisory
FAQ
What is CVE-2022-2310?
CVE-2022-2310 is a vulnerability with a CVSS score of 10.0 (CRITICAL). An authentication bypass vulnerability in Skyhigh SWG in main releases 10.x prior to 10.2.12, 9.x prior to 9.2.23, 8.x prior to 8.2.28, and controlled release 11.x prior to 11.2.1 allows a remote atta...
How severe is CVE-2022-2310?
CVE-2022-2310 has been rated CRITICAL with a CVSS base score of 10.0/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2022-2310?
Check the references section above for vendor advisories and patch information. Affected products include: Skyhighsecurity Secure Web Gateway.