Skip to content
OpenAdvisories
Medium WID-SEC-2023-1616 2 CVEs

ZScaler Client Connector: Mehrere Schwachstellen

Published Jul 2, 2023 · Updated Jul 2, 2023 · de-DE

Vendor: Zscaler Product: Client Connector Product: Client Connector < 1.10.1 Product: Client Connector < 1.10.2 Product: Client Connector < 1.4 Product: Client Connector < 1.9.3 Product: Client Connector < 3.7 Product: Client Connector < 3.9 Platform: Linux

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in ZScaler Client Connector ausnutzen, um Sicherheitsvorkehrungen zu umgehen oder einen Cross-Site-Scripting-Angriff durchzuführen.

Product

Zscaler Client Connector, ehemals Zscaler App (Z App) führt Sicherheits- und Richtlinienkontrollen auf verwalteten Endgeräten durch.

Vulnerabilities 2

  • High 8.2
    CVE-2023-28799

    A URL parameter during login flow was vulnerable to injection. An attacker could insert a malicious domain in this para…

    Zscaler Client Connector
  • High 8.1
    CVE-2023-28800

    Output encoding missing in redrurl parameter

    When using local accounts for administration, the redirect url parameter was not encoded correctly, allowing for an XSS attack providing admin login.

    Zscaler Client Connector

Revision history

  1. #1

    Initiale Fassung

References

  • ZScaler Security Advisory vom 2023-07-02
    https://help.zscaler.com/zscaler-client-connector/client-connector-app-release-summary-2021?applicable_category=Windows&applicable_version=3.7&deployment_date=2021-11-26&id=1386541
  • ZScaler Security Advisory vom 2023-07-02
    https://help.zscaler.com/client-connector/client-connector-app-release-summary-2023?applicable_category=macOS&applicable_version=3.9&deployment_date=2023-01-25&id=1443546
  • ZScaler Security Advisory vom 2023-07-02
    https://help.zscaler.com/client-connector/client-connector-app-release-summary-2023?applicable_category=iOS&applicable_version=1.9.3&deployment_date=2023-03-03&id=1447071
  • ZScaler Security Advisory vom 2023-07-02
    https://help.zscaler.com/client-connector/client-connector-app-release-summary-2023?applicable_category=Chrome+OS&applicable_version=1.10.1&deployment_date=2023-03-10&id=1447771
  • ZScaler Security Advisory vom 2023-07-02
    https://help.zscaler.com/client-connector/client-connector-app-release-summary-2023?applicable_category=Android&applicable_version=1.10.2&deployment_date=2023-03-09&id=1447706
  • ZScaler Security Advisory vom 2023-07-02
    https://help.zscaler.com/client-connector/client-connector-app-release-summary-2022?applicable_category=Linux&applicable_version=1.4&deployment_date=2022-10-31&id=1420246