CVE-2024-23458 — Local Privilege Escalation on Zscaler Client Connector on Windows

CVE-2024-23458

Local Privilege Escalation on Zscaler Client Connector on Windows PUBLISHED

Description (CNA)

While copying individual autoupdater log files, reparse point check was missing which could result into crafted attacks, potentially leading to a local privilege escalation. This issue affects Zscaler Client Connector on Windows <4.2.0.190.

Affected (CNA)

Vendor / product	Versions
Zscaler / Client Connector	affected 0 before 4.2.0.190

CWE

CWE-346

References

https://help.zscaler.com/client-connector/client-connector-app-release-summary-2023?applicable_category=windows&applicable_version=4.2.0.190

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.