Injection Vulnerability in Zscaler Client Connector for Multiple Platforms

CVE-2023-28799

What is CVE-2023-28799?

An injection vulnerability exists in the Zscaler Client Connector, where a URL parameter used during the login flow is susceptible to exploitation. Attackers can craft a malicious URL, inserting their domain into this parameter. Upon user authentication, the application redirects users to the malicious domain, potentially exposing the user's authorization token. This vulnerability underscores the importance of secure coding practices to prevent unauthorized access and potential data breaches.

References