← All advisories

High severity8.1NVD Advisory· Published Jun 22, 2023· Updated Jun 17, 2026

CVE-2023-28800

CVE-2023-28800

Description

When using local accounts for administration, the redirect url parameter was not encoded correctly, allowing for an XSS attack providing admin login.

Affected products

8

Zscaler/Client Connector8 versions
cpe:2.3:a:zscaler:client_connector:*:*:*:*:*:android:*:*+ 7 more
- cpe:2.3:a:zscaler:client_connector:*:*:*:*:*:android:*:*range: <1.10.2
- cpe:2.3:a:zscaler:client_connector:*:*:*:*:*:chrome_os:*:*range: <1.10.1
- cpe:2.3:a:zscaler:client_connector:*:*:*:*:*:iphone_os:*:*range: <1.9.3
- cpe:2.3:a:zscaler:client_connector:*:*:*:*:*:linux:*:*range: <1.4
- cpe:2.3:a:zscaler:client_connector:*:*:*:*:*:macos:*:*range: <3.9
- cpe:2.3:a:zscaler:client_connector:*:*:*:*:*:windows:*:*range: <3.7
- (no CPE)
- (no CPE)range: 0

Patches

Vulnerability mechanics

References

6

help.zscaler.com/client-connector/client-connector-app-release-summary-2022nvdRelease Notes
help.zscaler.com/client-connector/client-connector-app-release-summary-2023nvdRelease Notes
help.zscaler.com/client-connector/client-connector-app-release-summary-2023nvdRelease Notes
help.zscaler.com/client-connector/client-connector-app-release-summary-2023nvdRelease Notes
help.zscaler.com/client-connector/client-connector-app-release-summary-2023nvdRelease Notes
help.zscaler.com/zscaler-client-connector/client-connector-app-release-summary-2021nvdRelease Notes

News mentions

0

No linked articles in our index yet.