Skip to content
OpenAdvisories
Medium WID-SEC-2024-1014 2 CVEs

ZScaler Client Connector: Mehrere Schwachstellen

Published May 2, 2024 · Updated May 2, 2024 · de-DE

Vendor: Zscaler Product: Client Connector Platform: macOS

Summary

Ein Angreifer kann mehrere Schwachstellen in ZScaler Client Connector ausnutzen, um Dateien zu manipulieren oder einen Denial-of-Service-Zustand zu verursachen.

Product

Zscaler Client Connector, ehemals Zscaler App (Z App) führt Sicherheits- und Richtlinienkontrollen auf verwalteten Endgeräten durch.

Vulnerabilities 2

  • High 7.1
    CVE-2024-23459

    Multiple Arbitrary Creates/Overwrites by link following

    An Improper Link Resolution Before File Access ('Link Following') vulnerability in Zscaler Client Connector on Mac allows a system file to be overwritten.This issue affects Zscaler Client Connector on Mac : before 3.7.

    Zscaler Client Connector
  • Medium 4.2
    CVE-2024-23461

    ZCC macOS Upgrade ZIP Bomb DoS

    An Improper Validation of Integrity Check Value vulnerability in Zscaler Client Connector on MacOS during the upgrade process may allow a Local Execution of Code.This issue affects Client Connector on MacOS: before 3.4.

    Zscaler Client Connector

Revision history

  1. #1

    Initiale Fassung

References