Output encoding missing in redrurl parameter

CVE-2023-28800

What is CVE-2023-28800?

An XSS vulnerability exists in Zscaler Client Connector due to improper encoding of the redirect URL parameter when local accounts are used for administration. This flaw could allow an attacker to execute scripts in the context of an authenticated admin user, potentially leading to unauthorized access and administrative privileges. Users and administrators should prioritize updating their products to mitigate the risk associated with this security flaw.

References