Information disclosure in Skyhigh Secure Web Gateway
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-200.
Summary
An information disclosure vulnerability in SWG in versions 12.x prior to 12.2.10 and 11.x prior to 11.2.24 allows information stored in a customizable block page to be disclosed to third-party websites due to Same Origin Policy Bypass of browsers in certain scenarios. The risk is low, because other recommended default security policies such as URL categorization and GTI are in place in most policies to block access to uncategorized/high risk websites. Any information disclosed depends on how the customers have customized the block pages.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Skyhigh | Secure Web Gateway | SWG 12.x prior to 12.2.10 SWG 11.x prior to 11.2.24 | — | No fix listed | CNA |
- Secure Web Gateway VendorSkyhigh Affected SWG 12.x prior to 12.2.10 SWG 11.x prior to 11.2.24 Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:skyhighsecurity:secure_web_gateway:*:*:*:*:*:*:*:* | 11.0.0 to before 11.2.24; 12.0.0 to before 12.2.10 | Vulnerable | Skyhigh Security |
- cpe:2.3:a:skyhighsecurity:secure_web_gateway:*:*:*:*:*:*:*:* Versions 11.0.0 to before 11.2.24; 12.0.0 to before 12.2.10 Vulnerable ·Skyhigh Security
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2024-6398
- 2026-10-03 Alias added: GHSA-5f54-j5vv-v7h2
References
More Skyhigh vulnerabilities
- TI-2024-00287 A malicious insider exploiting this vulnerability can circumvent existing security… CVSS 3.1MEDIUM 5.5
- TI-2024-00285 A malicious insider can bypass the existing policy of Skyhigh Client Proxy without a valid release code. CVSS 3.1MEDIUM 5.5
- TI-2024-00286 A malicious insider can uninstall Skyhigh Client Proxy without a valid uninstall password. CVSS 3.1MEDIUM 5.5
Sources
- CVE-2024-6398 · CVE Program
- CVE-2024-6398 · NVD
- FIRST EPSS
- GHSA-5f54-j5vv-v7h2 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences