CVE-2023-41972 — Improper Handling of Insufficient Permissions or Privileges in Client Connector

CWE-280 — Improper Handling of Insufficient Permissions or PrivilegesCWE-269 — Improper Privilege Management3 documents3 sources
Severity
7.8HIGHNVD
CNA7.3
EPSS
0.1%
top 76.81%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Zscaler Client Connector
Timeline
PublishedMar 26

Description

In some rare cases, there is a password type validation missing in Revert Password check and for some features it could be disabled. Fixed Version: Win ZApp 4.3.0.121 and later.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages2 packages

▶CVEListV5zscaler/client_connector< 4.3.0.121
▶NVDzscaler/client_connector< 4.3.0.121

🔴Vulnerability Details

2
CVEList
Revert password check incorrect type validation↗2024-03-26
▶
GHSA
GHSA-jpgh-f7hm-pwmf: In some rare cases, there is a password type validation missing in Revert Password check and for some features it could be disabled↗2024-03-26
▶
CVE-2023-41972 — Zscaler Client Connector vulnerability | cvebase