CVE-2023-0214: XSS in Skyhigh Security SWG

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.9% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2023-01-18 · updated 2026-06-17
Weakness: CWE-79

Description

A cross-site scripting vulnerability in Skyhigh SWG in main releases 11.x prior to 11.2.6, 10.x prior to 10.2.17, and controlled release 12.x prior to 12.0.1 allows a remote attacker to craft SWG-specific internal requests with URL paths to any third-party website, causing arbitrary content to be injected into the response when accessed through SWG.

Affected products

Skyhigh Security Secure Web Gateway (SWG): from 10.0.0 before 10.2.17; from 11.0.0 before 11.2.6; 12.0.0 — fixed in 10.2.17, 11.2.6

How to fix

Upgrade to a fixed version: Skyhigh Security Secure Web Gateway (SWG) 10.2.17, 11.2.6. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-0214 or the next vulnerability affects your stack