Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2023-28800

Output encoding missing in redrurl parameter

Published
Last modified
published
Not listed in CISA KEV
None on Exploit-DB, Metasploit or GitHub
  • Exploitation: none
  • Automatable: no
  • Technical impact: total

Summary

When using local accounts for administration, the redirect url parameter was not encoded correctly, allowing for an XSS attack providing admin login.

Timeline

  1. CVE published
  2. CISA SSVC assessment

    Exploitation: none · Automatable: no · Technical impact: total

  3. Record last updated

Affected versions

  • Zscaler Client Connector

    Version range not reported

References 6

help.zscaler.com