Missing reparse point check in Client Connector could lead to local privilege escalation

CVE-2024-23458

What is CVE-2024-23458?

A local privilege escalation vulnerability exists in the Zscaler Client Connector on Windows due to a missing reparse point check while copying individual autoupdater log files. This security flaw could enable an attacker to exploit the system, allowing them to gain elevated privileges. It is essential for users running versions prior to 4.2.0.190 to review the applicable updates and apply necessary patches to mitigate this risk.

References