Lucene search

ZscalerCVE-2023-28801

HistoryAug 31, 2023 - 2:15 p.m.

CVE-2023-28801

2023-08-3114:15:08

CWE-347

Zscaler

web.nvd.nist.gov

cve-2023-28801

improper verification

cryptographic signature

saml authentication

zscaler admin ui

privilege escalation

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.5

Confidence

High

EPSS

0.002

Percentile

54.0%

JSON

An Improper Verification of Cryptographic Signature in the SAML authentication of the Zscaler Admin UI allows a Privilege Escalation.This issue affects Admin UI: from 6.2 before 6.2r.

Affected configurations

Nvd

Node

zscalerzscaler_internet_access_admin_portalRange6.2–6.2r

VendorProductVersionCPE
zscalerzscaler_internet_access_admin_portal*cpe:2.3:a:zscaler:zscaler_internet_access_admin_portal:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
zscaler	zscaler_internet_access_admin_portal	*	cpe:2.3:a:zscaler:zscaler_internet_access_admin_portal::::::::

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "ZIA Admin Portal",
    "vendor": "Zscaler",
    "versions": [
      {
        "lessThan": "6.2 (current)",
        "status": "affected",
        "version": "6.2",
        "versionType": "custom"
      }
    ]
  }
]

References

help.zscaler.com/zia/release-upgrade-summary-2023

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.5

Confidence

High

EPSS

0.002

Percentile

54.0%

JSON

Related for CVE-2023-28801