CVE-2024-23460 — Incorrect signature validation of package

CVE-2024-23460

Incorrect signature validation of package PUBLISHED

Description (CNA)

The Zscaler Updater process does not validate the digital signature of the installer before execution, allowing arbitrary code to be locally executed. This affects Zscaler Client Connector on MacOS <4.2.

Affected (CNA)

Vendor / product	Versions
Zscaler / Client Connector	affected 0 before 4.2

CWE

CWE-347

References

https://help.zscaler.com/client-connector/client-connector-app-release-summary-2023?applicable_category=macos&applicable_version=4.2

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.