A URL parameter during login flow was vulnerable to injection. An attacker could insert a malicious domain in this parameter, which would redirect the user after auth and send the authorization token to the redirected domain.
2023-06-22T20:15:09.283
2024-11-21T07:56:02.213
Modified
CVSSv3.1: 8.2 (HIGH)
| Type | Vendor | Product | Version/Range | Vulnerable? |
|---|---|---|---|---|
| Application | zscaler | client_connector | < 1.4 | Yes |
| Application | zscaler | client_connector | < 1.9.3 | Yes |
| Application | zscaler | client_connector | < 1.10.1 | Yes |
| Application | zscaler | client_connector | < 1.10.2 | Yes |
| Application | zscaler | client_connector | < 3.7 | Yes |
| Application | zscaler | client_connector | < 3.9 | Yes |