Lucene search
HistoryAug 06, 2024 - 4:15 p.m.
CVE-2024-23458
autoupdater log files
reparse point check
crafted attacks
local privilege escalation
zscaler client connector
windows security
CVSS3
7.8
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS
0
Percentile
9.5%
While copying individual autoupdater log files, reparse point check was missing which could result into crafted attacks, potentially leading to a local privilege escalation. This issue affects Zscaler Client Connector on Windows <4.2.0.190.
Affected configurations
Node
zscalerclient_connectorRange<4.2.0.190windows
| Vendor | Product | Version | CPE |
|---|---|---|---|
| zscaler | client_connector | * | cpe:2.3:a:zscaler:client_connector:*:*:*:*:*:windows:*:* |
CVSS3
7.8
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS
0
Percentile
9.5%
Related for NVD:CVE-2024-23458