High severity8.2NVD Advisory· Published Jun 22, 2023· Updated Jun 17, 2026
CVE-2023-28799
CVE-2023-28799
Description
A URL parameter during login flow was vulnerable to injection. An attacker could insert a malicious domain in this parameter, which would redirect the user after auth and send the authorization token to the redirected domain.
Affected products
8cpe:2.3:a:zscaler:client_connector:*:*:*:*:*:android:*:*+ 7 more
- cpe:2.3:a:zscaler:client_connector:*:*:*:*:*:android:*:*range: <1.10.2
- cpe:2.3:a:zscaler:client_connector:*:*:*:*:*:chrome_os:*:*range: <1.10.1
- cpe:2.3:a:zscaler:client_connector:*:*:*:*:*:iphone_os:*:*range: <1.9.3
- cpe:2.3:a:zscaler:client_connector:*:*:*:*:*:linux:*:*range: <1.4
- cpe:2.3:a:zscaler:client_connector:*:*:*:*:*:macos:*:*range: <3.9
- cpe:2.3:a:zscaler:client_connector:*:*:*:*:*:windows:*:*range: <3.7
- (no CPE)
- (no CPE)range: 0
Patches
Vulnerability mechanics
References
6- help.zscaler.com/client-connector/client-connector-app-release-summary-2022nvdRelease Notes
- help.zscaler.com/client-connector/client-connector-app-release-summary-2023nvdRelease Notes
- help.zscaler.com/client-connector/client-connector-app-release-summary-2023nvdRelease Notes
- help.zscaler.com/client-connector/client-connector-app-release-summary-2023nvdRelease Notes
- help.zscaler.com/client-connector/client-connector-app-release-summary-2023nvdRelease Notes
- help.zscaler.com/zscaler-client-connector/client-connector-app-release-summary-2021nvdRelease Notes
News mentions
0No linked articles in our index yet.