Output encoding missing in redrurl parameter
CVE-2023-28800
8.1HIGH
What is CVE-2023-28800?
An XSS vulnerability exists in Zscaler Client Connector due to improper encoding of the redirect URL parameter when local accounts are used for administration. This flaw could allow an attacker to execute scripts in the context of an authenticated admin user, potentially leading to unauthorized access and administrative privileges. Users and administrators should prioritize updating their products to mitigate the risk associated with this security flaw.
Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.
Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.
Affected Version(s)
Client Connector 0 < 3.9 Mac, 3.7 Win, 1.9.3 iOS, 1.10.2 Android, 1.10.1 Chrome OS, 1.4 Linux
References
CVSS V3.1
Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Tesla Red Team