Password Validation Missing in Revert Password Check
CVE-2023-41972

7.3HIGH

Key Information:

Vendor

Zscaler

Status
Client Connector
Vendor
CVE Published:
26 March 2024

Badges

đź“° News Worthy

What is CVE-2023-41972?

A vulnerability has been identified in Zscaler's Win ZApp affecting its password validation mechanism within the Revert Password check. In specific scenarios, this critical validation check may be bypassed or disabled, which presents a risk of unauthorized access to user accounts. Users are strongly advised to upgrade to Win ZApp version 4.3.0.121 or later, which addresses this issue effectively. Timely patching is crucial for maintaining the security integrity of systems utilizing this application.

Affected Version(s)

Client Connector Windows 0 < 4.3.0.121

News Articles

favicon imageThreat Intelligence Radar

Threat Intel Roundup: glibc, Anatsa, iconv, NahamCon – Threat Radar Intelligence

admin May 28, 2024 No Comments Technical Summary Zero-Interaction Local Privilege Escalation in...

favicon imageCybersecurityNews

Zscaler Client Connector Zero-interaction Privilege Escalation Vulnerability

A new privilege escalation vulnerability has been discovered in Zscaler Client Connector which involves combining three different

References

https://help.zscaler.com/client-connector/client-connecto...

CVSS V3.1

Score:
7.3
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • đź“°

    First article discovered by CybersecurityNews

  • Vulnerability published

  • Vulnerability Reserved

Credit

Singapore GovTech Red Team
.