CVE-2022-2310 is a critical authentication bypass vulnerability affecting Skyhigh Secure Web Gateway (SWG) versions 10.x, 9.x, 8.x, and 11.x prior to their respective patched releases. This flaw allows a remote attacker to gain complete administrative control over the SWG by exploiting incorrectly whitelisted authentication bypass methods and a weak cryptographic password. With a CVSS score of 9.8, this vulnerability is easily exploitable over the network with low attack complexity, leading to full compromise of confidentiality, integrity, and availability. While no active exploitation or public exploit code has been identified, and community discussion is minimal, the high risk score of 80/100 warrants immediate patching.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 8.0.0, < 8.2.28CPE matchmatch criteria | cpe:2.3:a:skyhighsecurity:secure_web_gateway:*:*:*:*:*:*:*:* | ||
>= 9.0.0, < 9.2.23CPE matchmatch criteria | cpe:2.3:a:skyhighsecurity:secure_web_gateway:*:*:*:*:*:*:*:* | ||
>= 10.0.0, < 10.2.12CPE matchmatch criteria | cpe:2.3:a:skyhighsecurity:secure_web_gateway:*:*:*:*:*:*:*:* | ||
>= 11.0.0, < 11.2.1CPE matchmatch criteria | cpe:2.3:a:skyhighsecurity:secure_web_gateway:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.