CVE-2023-0214: Trellix Skyhigh Secure Web Gateway

Medium severity, CVSS 6.1. EPSS: 1.9% chance of exploitation in the next 30 days.

A cross-site scripting vulnerability in Skyhigh SWG in main releases 11.x prior to 11.2.6, 10.x prior to 10.2.17, and controlled release 12.x prior to 12.0.1 allows a remote attacker to craft SWG-specific internal requests with URL paths to any third-party website, causing arbitrary content to be injected into the response when accessed through SWG.

Affected products

• Trellix Skyhigh Secure Web Gateway: from 10.0.0, before 10.2.17 (fixed in 10.2.17); from 11.0.0, before 11.2.6 (fixed in 11.2.6); version 12.0.0 only

Published 2023-01-18. Last modified 2026-06-17.