CVE-2023-28799: Input Validation
A URL parameter during login flow was vulnerable to injection. An attacker could insert a malicious domain in this parameter, which would redirect the user after auth and send the authorization token to the redirected domain.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-28799?
CVE-2023-28799 is a vulnerability in Zscaler Client Connector that allows an attacker to insert a malicious domain into a URL parameter during the login flow, which could redirect the user and send the authorization token to the redirected domain.
What software is affected by CVE-2023-28799?
Zscaler Client Connector versions up to 1.4 for Linux, up to 1.9.3 for iPhone OS, up to 1.10.1 for Chrome OS, up to 1.10.2 for Android, up to 3.7 for Windows, and up to 3.9 for macOS are affected by CVE-2023-28799.
What is the severity of CVE-2023-28799?
CVE-2023-28799 has a severity rating of 6.1 out of 10, indicating a high level of risk.
How can I mitigate the vulnerability?
To mitigate the vulnerability, it is recommended to update Zscaler Client Connector to the latest version as provided by Zscaler.
Where can I find more information about CVE-2023-28799?
You can find more information about CVE-2023-28799 on the Zscaler website: [link].