DeutschShown in its original language — a full translation is planned for a future version.
ZScaler Client Connector: Mehrere Schwachstellen
view advisory published 2024-08-06
Ein Angreifer kann mehrere Schwachstellen in ZScaler Client Connector ausnutzen, um Sicherheitsvorkehrungen zu umgehen, erhöhte Rechte zu erlangen und beliebigen Code auszuführen.
01
describes (6)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2024-23483US | critical9.8 | — | ||
An Improper Input Validation vulnerability in Zscaler Client Connector on MacOS allows OS Command Injection. This issue affects Zscaler Client Connector on MacOS <4.2. | ||||
| CVE-2024-23464US | medium4.9 | — | ||
In certain cases, Zscaler Internet Access (ZIA) can be disabled by PowerShell commands with admin rights. This affects Zscaler Client Connector on Windows <4.2.1 | ||||
| CVE-2024-23460US | high7.8 | — | ||
The Zscaler Updater process does not validate the digital signature of the installer before execution, allowing arbitrary code to be locally executed. This affects Zscaler Client C… | ||||
| CVE-2024-23458US | high7.8 | — | ||
While copying individual autoupdater log files, reparse point check was missing which could result into crafted attacks, potentially leading to a local privilege escalation. This i… | ||||
| CVE-2024-23456US | high7.5 | — | ||
Anti-tampering can be disabled under certain conditions without signature validation. This affects Zscaler Client Connector <4.2.0.190 with anti-tampering enabled. | ||||
| CVE-2023-28806US | medium6.5 | — | ||
An Improper Validation of signature in Zscaler Client Connector on Windows allows an authenticated user to disable anti-tampering. This issue affects Client Connector on Windows <4… | ||||
02
references
External citations — patches, advisories, analysis.
- NIST Vulnerability Database vom 2024-08-06external
- NIST Vulnerability Database vom 2024-08-06external
- NIST Vulnerability Database vom 2024-08-06external
- NIST Vulnerability Database vom 2024-08-06external
- NIST Vulnerability Database vom 2024-08-06external
- NIST Vulnerability Database vom 2024-08-06external
- WID-SEC-W-2024-1779 - CSAF Versionself
- WID-SEC-2024-1779 - Portal Versionself
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan