CVE-2023-41973 — Lack of input santization on Zscaler Client Connector enables arbitrary code execution
ZSATray passes the previousInstallerName as a config parameter to TrayManager, and TrayManager constructs the path and appends previousInstallerName to get the full path of the …
Published: 2024-03-26 · CVSS: 7.3 · CVSS 3.1
ZSATray passes the previousInstallerName as a config parameter to TrayManager, and TrayManager constructs the path and appends previousInstallerName to get the full path of the exe. Fixed Version: Win ZApp 4.3.0.121 and later.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7