Skip to content
CVE PROGRAM SOURCE RECORD7.3 High

CVE-2023-41973

Lack of input santization on Zscaler Client Connector enables arbitrary code execution

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Zscaler

Description

ZSATray passes the previousInstallerName as a config parameter to TrayManager, and TrayManager constructs the path and appends previousInstallerName to get the full path of the exe. Fixed Version: Win ZApp 4.3.0.121 and later.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Zscaler Client Connector

Default version status: unaffected

  • 0 to < 4.3.0.121affected

References