CVE-2023-28799
22.06.2023, 20:15
A URL parameter during login flow was vulnerable to injection. An attacker could insert a malicious domain in this parameter, which would redirect the user after auth and send the authorization token to the redirected domain.
| Vendor | Product | Version |
|---|---|---|
| zscaler | client_connector | 𝑥 < 1.4 |
| zscaler | client_connector | 𝑥 < 1.10.1 |
| zscaler | client_connector | 𝑥 < 3.7 |
| zscaler | client_connector | 𝑥 < 3.9 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-1287 - Improper Validation of Specified Type of InputThe product receives input that is expected to be of a certain type, but it does not validate or incorrectly validates that the input is actually of the expected type.
- CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
References