Description (CNA)
Netskope was notified about a security gap in Netskope Client enrollment process where NSClient is using a static token “Orgkey” as authentication parameter. Since this is a static token, if leaked, cannot be rotated or revoked. A malicious actor can use this token to enroll NSClient from a customer’s tenant and impersonate a user.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Netskope / Netskope Client | unknown All |
CWE
CWE-287
References
- https://www.netskope.com/company/security-compliance-and-assurance/security-advisories-and-disclosures/netskope-security-advisory-nskpsa-2024-001
- https://docs.netskope.com/en/secure-enrollment/
- https://quickskope.com/
ADP enrichment
No English description supplied.
No references supplied.