// For flags

CVE-2023-4400

 

Severity Score

6.5
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

A password management vulnerability in Skyhigh Secure Web Gateway (SWG) in main releases 11.x prior to 11.2.14, 10.x prior to 10.2.25 and controlled release 12.x prior to 12.2.1, allows some authentication information stored in configuration files to be extracted through SWG REST API. This was possible due to SWG storing the password in plain text in some configuration files.

Una vulnerabilidad de administración de contraseñas en Skyhigh Secure Web Gateway (SWG) en las versiones principales 11.x anteriores a 11.2.14, 10.x anteriores a 10.2.25 y la versión controlada 12.x anterior a 12.2.1, permite que cierta información de autenticación se almacene en archivos de configuración que se extraerán a través de SWG REST API. Esto fue posible gracias a que SWG almacenó la contraseña en texto plano en algunos archivos de configuración.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
Required
Scope
Changed
Confidentiality
High
Integrity
None
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2023-08-17 CVE Reserved
  • 2023-09-13 CVE Published
  • 2024-08-02 CVE Updated
  • 2024-09-19 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-256: Plaintext Storage of a Password
  • CWE-312: Cleartext Storage of Sensitive Information
CAPEC
  • CAPEC-37: Retrieve Embedded Sensitive Data
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Skyhighsecurity
Search vendor "Skyhighsecurity"
 Secure Web Gateway
Search vendor "Skyhighsecurity" for product "Secure Web Gateway"
 >= 10.0.0 < 10.2.25
Search vendor "Skyhighsecurity" for product "Secure Web Gateway" and version " >= 10.0.0 < 10.2.25"
-
Affected
Skyhighsecurity
Search vendor "Skyhighsecurity"
 Secure Web Gateway
Search vendor "Skyhighsecurity" for product "Secure Web Gateway"
 >= 11.0.0 < 11.2.14
Search vendor "Skyhighsecurity" for product "Secure Web Gateway" and version " >= 11.0.0 < 11.2.14"
-
Affected
Skyhighsecurity
Search vendor "Skyhighsecurity"
 Secure Web Gateway
Search vendor "Skyhighsecurity" for product "Secure Web Gateway"
 >= 12.0.0 < 12.2.1
Search vendor "Skyhighsecurity" for product "Secure Web Gateway" and version " >= 12.0.0 < 12.2.1"
-
Affected