Skip to content
CVE PROGRAM SOURCE RECORD6.3 Medium

CVE-2023-28797

LPE using arbitrary file delete with Symlinks

Description

Zscaler Client Connector for Windows before 4.1 writes/deletes a configuration file inside specific folders on the disk. A malicious user can replace the folder and execute code as a privileged user.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Zscaler Client Connector

Default version status: unaffected

  • 0 to < 4.1affected

References