CVE-2024-23463
Plain English Summary
AI-powered analysis for quick understanding
An attacker can bypass the security measures of the Zscaler Client Connector on Windows, allowing them to tamper with the application, but this can only happen if the "Repair App" feature is used. This vulnerability affects versions prior to 4.2.1, so it's crucial to update to the latest version to protect against this risk.
Technical Description
Anti-tampering protection of the Zscaler Client Connector can be bypassed under certain conditions when running the Repair App functionality. This affects Zscaler Client Connector on Windows prior to 4.2.1
CVSS Vector Analysis
Vector String
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HExploit Resources
Search for proof-of-concept code and exploit modules
Official References
Quick Information
Published
Apr 30, 2024
almost 2 years ago
Last Modified
Mar 2, 2026
about 1 month ago
Vendor
zscaler
Product
client connector
Related Vulnerabilities
This vulnerability allows an authenticated administrator to potentially access unauthorized internal information through the Zscaler Internet Access Admin portal. However, this can only happen under rare conditions where the input provided by the user is not properly handled.
This vulnerability allows an authenticated administrator to potentially execute backend functions by entering specific inputs in the Zscaler Internet Access Admin Portal. However, it only occurs under limited scenarios where the input validation is not properly enforced.
This vulnerability allows an attacker to overwrite important system files on Windows machines running Zscaler Client Connector versions before 3.7. To exploit this, the attacker needs to trick the system into following a malicious link that leads to the targeted file.
This vulnerability allows an attacker to disable the security features that protect the Zscaler Client Connector, potentially letting them uninstall the software without proper authorization. This issue occurs when an uninstall password is set, and it affects versions of the software prior to 4.2.0.209 on Windows systems.