PatchTheCVECVE-2024-3378: A vulnerability has been found in iboss Secure Web Gateway up to 10.1 and classified as problematic
CVE-2024-3378 is a medium-severity flaw (CVSS 4.3) affecting secure web gateway. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
A vulnerability has been found in iboss Secure Web Gateway up to 10.1 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /login of the component Login Portal. The manipulation of the argument redirectUrl leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 10.2.0.160 is able to address this issue. It
Why this priority
- EPSS top 2%: very likely to be exploited
- Public exploit reference
A fixed release or distro patch exists.
Risk facts
| CVSS score | 4.3 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | Required |
| EPSS exploit chance | 23.1% (top 2%) |
| CISA exploited list | No |
| Weakness | CWE-79 |
| Published | 2024-04-06 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Public exploits and detection
Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.
- Nuclei scan template: iboss Secure Web Gateway - Stored Cross-Site Scripting
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2024-3378?
secure web gateway: upgrade to 10.2.0.160. Exact commands for each OS are on this page.
Is CVE-2024-3378 being exploited?
CVE-2024-3378 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2024-3378 affect?
CVE-2024-3378 affects secure web gateway. Severity is medium (CVSS 4.3). A vulnerability has been found in iboss Secure Web Gateway up to 10.1 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /login of the component Login Portal. The manipulation of the argume
How urgent is CVE-2024-3378?
Priority 44/100. EPSS top 2%: very likely to be exploited; Public exploit reference
Related CVEs
- CVE-2024-6398 MEDIUM 4.3 UPGRADE An information disclosure vulnerability in SWG in versions 12.x prior to 12.2.10 and 11.x prior to 11.2.24 all
- CVE-2023-4400 MEDIUM 6.2 UPGRADE A password management vulnerability in Skyhigh Secure Web Gateway (SWG) in main releases 11.x prior to 11.2.1