Skip to content
CVE PROGRAM SOURCE RECORD5.2 Medium

CVE-2024-13177

Symlink Following in Netskope Client Postinstall Script

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Netskope

Description

Netskope Client on Mac OS is impacted by a vulnerability in which the postinstall script does not properly validate the path of the file “nsinstallation”. A standard user could potentially create a symlink of the file “nsinstallation” to escalate the privileges of a different file on the system. This issue affects Netskope Client: before 123.0, before 117.1.11.2310, before 120.1.10.2306.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Netskope Netskope Client

Default version status: unaffected

  • 0 to < 123.0affected
  • 0 to < 117.1.11.2310affected
  • 0 to < 120.1.10.2306affected

References