CVE-2024-23460CWE-347

Incorrect signature validation of package

Medium · published August 6, 2024

CVSS v3.1
6.4
EPSS
0%
Percentile
2.1
In the wild
Unconfirmed
What it is

The Zscaler Updater process does not validate the digital signature of the installer before execution, allowing arbitrary code to be locally executed. This affects Zscaler Client Connector on MacOS <4.2.

The record
Technical detail
CVSS v3.1
6.4 · MEDIUM
Vector
CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00126 · 2.1th percentile
Weakness
CWE-347 · Improper Verification of Cryptographic Signature
Published
2024-08-06T15:29Z
EPSS history
Timeline
  • 06 AUG 15:29Z
    Incorrect signature validation of package
    cvelistv5