High severity · published Aug 6, 2024
CVE-2024-23460
Incorrect signature validation of package
7.8
CVSS
0.1%
EPSS
No
On KEV
Description
The Zscaler Updater process does not validate the digital signature of the installer before execution, allowing arbitrary code to be locally executed. This affects Zscaler Client Connector on MacOS <4.2.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 2% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CC
Client Connector · Zscaler
before 4.2 · source: vendor, NVD, CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-23460
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-23460
Vendor Advisory
https://help.zscaler.com/client-connector/client-connector-app-release-summary-2023?applicable_category=macos&applicable_version=4.2
More from Client Connector
9.8
CVE-2024-23483
Local Privilege Escalation via lack of input validation
9.8
CVE-2024-23459
Multiple Arbitrary Creates/Overwrites by link following
9.8
CVE-2023-28798
Out-of-bounds write to heap in pacparser
9.8
CVE-2024-23480
Insecure MacOS code sign check fallback
9.8
CVE-2023-28805
ZCC on Linux privilege escalation