PT-2023-21974 · Zscaler · Client Connector

Published 2023-06-22 · Updated 2024-10-17 · CVE-2023-28799

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned.

Description A URL parameter during the login flow was vulnerable to injection, allowing an attacker to insert a malicious domain. This would redirect the user after authentication and send the authorization token to the redirected domain.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Open Redirect

Weakness Enumeration

CWE-601

CWE-1287

Related Identifiers

CVE-2023-28799

Affected Products

Client Connector

References · 10

• https://osv.dev/vulnerability/CVE-2023-28799 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-28799 · Security Note
• https://t.me/cvenotify/52900 · Telegram Post
• https://help.zscaler.com/client-connector/client-connector-app-release-summary-2023?applicable_category=iOS&applicable_version=1.9.3&deployment_date=2023-03-03&id=1447071 · Note
• https://help.zscaler.com/client-connector/client-connector-app-release-summary-2023?applicable_category=Android&applicable_version=1.10.2&deployment_date=2023-03-09&id=1447706 · Note
• https://help.zscaler.com/client-connector/client-connector-app-release-summary-2023?applicable_category=Chrome%20OS&applicable_version=1.10.1&deployment_date=2023-03-10&id=1447771 · Note
• https://help.zscaler.com/zscaler-client-connector/client-connector-app-release-summary-2021?applicable_category=Windows&applicable_version=3.7&deployment_date=2021-11-26&id=1386541 · Note
• https://help.zscaler.com/client-connector/client-connector-app-release-summary-2023?applicable_category=macOS&applicable_version=3.9&deployment_date=2023-01-25&id=1443546 · Note
• https://t.me/cvenotify/98515 · Telegram Post
• https://help.zscaler.com/client-connector/client-connector-app-release-summary-2022?applicable_category=Linux&applicable_version=1.4&deployment_date=2022-10-31&id=1420246 · Note