Skip to content
OpenAdvisories
High · 8.1 CVE-2023-28800 EUVD-2023-32435GHSA-crh5-rq78-8m4h

Output encoding missing in redrurl parameter

Published Jun 22, 2023 · Updated Dec 6, 2024 · Assigned by Zscaler

Vendor: Zscaler Product: Client Connector

Description

When using local accounts for administration, the redirect url parameter was not encoded correctly, allowing for an XSS attack providing admin login.

Affected products

VendorProductAffectedFixed
Zscaler Client Connector < 3.9 Mac, 3.7 Win, 1.9.3 iOS, 1.10.2 Android, 1.10.1 Chrome OS, 1.4 Linux 3.9 Mac, 3.7 Win, 1.9.3 iOS, 1.10.2 Android, 1.10.1 Chrome OS, 1.4 Linux

Advisories 1

References