CVE-2024-6398

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

An information disclosure vulnerability in SWG in versions 12.x prior to 12.2.10 and 11.x prior to 11.2.24 allows information stored in a customizable block page to be disclosed to third-party websites due to Same Origin Policy Bypass of browsers in certain scenarios. The risk is low, because other recommended default security policies such as URL categorization and GTI are in place in most policies to block access to uncategorized/high risk websites. Any information disclosed depends on how the customers have customized the block pages.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
Skyhigh	Secure Web Gateway	SWG 12.x prior to 12.2.10 SWG 11.x prior to 11.2.24

References

https://thrive.trellix.com/s/article/000013694Permissions Required
https://thrive.trellix.com/s/article/000013694Permissions Required

Timeline

Published: Jul 15, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-64007.5Cleartext Storage of Sensitive Information, Exposure of Sensitive Information Through Data Queries vulnerability in Finrota Netahsilat allow CVE-2024-64019.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SFS Consulting InsureE GL allows SQL I CVE-2024-64029.8A vulnerability classified as critical was found in Tenda A301 15.13.08.12. Affected by this vulnerability is the function fromSetWirelessRe CVE-2024-64039.8A vulnerability, which was classified as critical, has been found in Tenda A301 15.13.08.12. Affected by this issue is the function formWifi CVE-2024-64055.4The Floating Social Buttons plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5. This CVE-2024-64068.5Missing Authentication for Critical Function, Missing Authorization vulnerability in Yordam Information Technology Mobile Library Applicatio CVE-2024-64077.5CWE-200: Information Exposure vulnerability exists that could cause disclosure of credentials when a specially crafted message is sent to th CVE-2024-64085.4The Slider by 10Web WordPress plugin before 1.2.57 does not sanitise and escape its Slider Title, which could allow high privilege users su CVE-2024-64097.0A race condition vulnerability was discovered in how signals are handled by OpenSSH's server (sshd). If a remote attacker does not authentic CVE-2024-64104.3The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versio CVE-2024-64118.8The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to privilege escalation in all versions up to, an CVE-2024-64126.5The HTML Forms WordPress plugin before 1.3.34 does not have CSRF checks in some places, which could allow attackers to make logged in users