CVE-2023-4400

6.5 mediumEPSS 0.4%

Medium (6.5) in skyhighsecurity secure web gateway. EPSS 0.4% chance of exploitation in the next 30 days.

A password management vulnerability in Skyhigh Secure Web Gateway (SWG) in main releases 11.x prior to 11.2.14, 10.x prior to 10.2.25 and controlled release 12.x prior to 12.2.1, allows some authentication information stored in configuration files to be extracted through SWG REST API. This was possible due to SWG storing the password in plain text in some configuration files.

Severity

CVSS 3.1

6.5 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 29% of CVEs (scores of 2026-10-31)
CWEs: CWE-312, CWE-256
Published: 2023-09-13
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

skyhighsecurity:secure_web_gateway

References

https://kcm.trellix.com/corporate/index?page=content&id=SB10406
https://github.com/advisories/GHSA-qggp-c2rq-6x65
https://kcm.trellix.com/corporate/index?page=content&id=SB10406

Check your stack JSON