PT-2023-12107 · Zscaler · Zscaler Client Connector Installer

Published 2023-10-23 · Updated 2023-10-27 · CVE-2021-26734

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Zscaler Client Connector Installer on Windows versions prior to 3.4.0.124

Description The issue arises from the improper handling of directory junctions during the uninstallation process of the Zscaler Client Connector Installer on Windows. This could allow a local adversary to delete folders in an elevated context.

Recommendations For versions prior to 3.4.0.124, update to version 3.4.0.124 or later to resolve the issue. As a temporary workaround, consider restricting access to the uninstallation process to minimize the risk of exploitation.

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2021-26734

Affected Products

Zscaler Client Connector Installer

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2021-26734 · Security Note
• https://osv.dev/vulnerability/CVE-2021-26734 · Vendor Advisory
• https://help.zscaler.com/zscaler-client-connector/client-connector-app-release-summary-2021 · Note
• https://twitter.com/CVEnew/status/1716448950142562479 · Twitter Post
• https://twitter.com/DMFezzaReedCISA/status/1716488485509517575 · Twitter Post
• https://t.me/cibsecurity/72772 · Telegram Post