High severity · published Mar 26, 2024
CVE-2023-41969
ZSATrayManager Arbitrary File Deletion
7.1
CVSS
0.3%
EPSS
No
On KEV
Description
An arbitrary file deletion in ZSATrayManager where it protects the temporary encrypted ZApp issue reporting file from the unprivileged end user access and modification. Fixed version: Win ZApp 4.3.0 and later.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 23% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CC
Client Connector · Zscaler
before 4.3.0 · source: vendor, NVD, CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-41969
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-41969
Release Notes
https://help.zscaler.com/client-connector/client-connector-app-release-summary-2023
More from Client Connector
9.8
CVE-2024-23483
Local Privilege Escalation via lack of input validation
9.8
CVE-2024-23459
Multiple Arbitrary Creates/Overwrites by link following
9.8
CVE-2023-28798
Out-of-bounds write to heap in pacparser
9.8
CVE-2024-23480
Insecure MacOS code sign check fallback
9.8
CVE-2023-28805
ZCC on Linux privilege escalation