CVE-2024-23460
Incorrect signature validation of package
- State
- Published
- Severity
- 6.4 Medium
- Published
- Aug 6, 2024
- Updated
- Aug 6, 2024
- Reserved
- Jan 17, 2024
Description
The Zscaler Updater process does not validate the digital signature of the installer before execution, allowing arbitrary code to be locally executed. This affects Zscaler Client Connector on MacOS <4.2.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 6.4 Medium | CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N | Zscaler |
Weaknesses
- CWE-347 Improper Verification of Cryptographic Signature
Affected Products
| Product | Versions |
|---|---|
Client ConnectorZscaler |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.