CVE-2023-28800

Published: Jun 22, 2023Modified: Nov 21, 2024

6.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.7

Source: NVD

Description

When using local accounts for administration, the redirect url parameter was not encoded correctly, allowing for an XSS attack providing admin login.

Affected (6)

Products: Zscaler: Client Connector

1 product

Client Connector

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Zscaler Client Connector	Before 1.10.2
Zscaler Client Connector	Before 1.10.1
Zscaler Client Connector	Before 1.9.3
Zscaler Client Connector	Before 1.4
Zscaler Client Connector	Before 3.9
Zscaler Client Connector	Before 3.7

Related CWEs

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (12)

https://help.zscaler.com/client-connector/client-connector-app-release-summary-2022?applicable_category=Linux&applicable_version=1.4&deployment_date=2022-10-31&id=1420246

Source: cve@zscaler.com

Release Notes

https://help.zscaler.com/client-connector/client-connector-app-release-summary-2023?applicable_category=Android&applicable_version=1.10.2&deployment_date=2023-03-09&id=1447706

Source: cve@zscaler.com

Release Notes

https://help.zscaler.com/client-connector/client-connector-app-release-summary-2023?applicable_category=Chrome%20OS&applicable_version=1.10.1&deployment_date=2023-03-10&id=1447771

Source: cve@zscaler.com

Release Notes

https://help.zscaler.com/client-connector/client-connector-app-release-summary-2023?applicable_category=iOS&applicable_version=1.9.3&deployment_date=2023-03-03&id=1447071

Source: cve@zscaler.com

Release Notes

https://help.zscaler.com/client-connector/client-connector-app-release-summary-2023?applicable_category=macOS&applicable_version=3.9&deployment_date=2023-01-25&id=1443546

Source: cve@zscaler.com

Release Notes

https://help.zscaler.com/zscaler-client-connector/client-connector-app-release-summary-2021?applicable_category=Windows&applicable_version=3.7&deployment_date=2021-11-26&id=1386541

Source: cve@zscaler.com

Release Notes

https://help.zscaler.com/client-connector/client-connector-app-release-summary-2022?applicable_category=Linux&applicable_version=1.4&deployment_date=2022-10-31&id=1420246

Source: af854a3a-2127-422b-91ae-364da2661108

Release Notes

https://help.zscaler.com/client-connector/client-connector-app-release-summary-2023?applicable_category=Android&applicable_version=1.10.2&deployment_date=2023-03-09&id=1447706

Source: af854a3a-2127-422b-91ae-364da2661108

Release Notes

https://help.zscaler.com/client-connector/client-connector-app-release-summary-2023?applicable_category=Chrome%20OS&applicable_version=1.10.1&deployment_date=2023-03-10&id=1447771

Source: af854a3a-2127-422b-91ae-364da2661108

Release Notes

https://help.zscaler.com/client-connector/client-connector-app-release-summary-2023?applicable_category=iOS&applicable_version=1.9.3&deployment_date=2023-03-03&id=1447071

Source: af854a3a-2127-422b-91ae-364da2661108

Release Notes

https://help.zscaler.com/client-connector/client-connector-app-release-summary-2023?applicable_category=macOS&applicable_version=3.9&deployment_date=2023-01-25&id=1443546

Source: af854a3a-2127-422b-91ae-364da2661108

Release Notes

https://help.zscaler.com/zscaler-client-connector/client-connector-app-release-summary-2021?applicable_category=Windows&applicable_version=3.7&deployment_date=2021-11-26&id=1386541

Source: af854a3a-2127-422b-91ae-364da2661108

Release Notes

Timeline

No history available yet.