CVE-2024-23460 Incorrect signature validation of package

Q: Is CVE-2024-23460 being exploited?

There is no known exploitation of CVE-2024-23460 in the wild and no public exploit code.

Q: How do I fix CVE-2024-23460?

No fix has been published for CVE-2024-23460 yet. Limit exposure of the affected software until one is available.

Medium 6.4 Published 6 Aug 2024 Updated 6 Aug 2024

Local attackers can execute arbitrary code by bypassing digital signature validation in the Zscaler Client Connector updater on macOS.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2024-23460?

CVE-2024-23460 is a medium-severity vulnerability in Zscaler Client Connector, published on 6 Aug 2024. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

The Zscaler Updater process does not validate the digital signature of the installer before execution, allowing arbitrary code to be locally executed. This affects Zscaler Client Connector on MacOS <4.2.

Weakness: CWE-347

Which versions are affected by CVE-2024-23460?

It affects 1 product.

Products include Zscaler Client Connector.

How do I fix CVE-2024-23460?

No fix has been published for CVE-2024-23460 yet. Limit exposure of the affected software until one is available.

Is CVE-2024-23460 being exploited?

There is no known exploitation of CVE-2024-23460 in the wild and no public exploit code.

Sources

Also known as GHSA-63rm-c268-28fh.