CVE-2023-28795

Client IPC validation bypass

High7.8EPSS 0.15%

Published: 23 Oct 2023
Updated: 27 Feb 2025
Reserved: 23 Mar 2023
Assigned by: Zscaler

Description

Origin Validation Error vulnerability in Zscaler Client Connector on Linux allows Inclusion of Code in Existing Process. This issue affects Zscaler Client Connector for Linux: before 1.3.1.6.

Scores

CVSS scores of CVE-2023-28795, by who scored it
Scored by	CVSS	Score	Vector
ZscalerCNA (assigner)	3.1	High7.8	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVDNVD · Modified	3.1	High7.8	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS (exploitation in 30 days): 0.15% · top 96% of all CVEs (6 Nov 2026)
CISA SSVC: Exploitation: none · Automatable: no · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.8.

Weakness

CWE-346 Origin Validation Error (opens in a new tab)All about CWE-346 and its CVEs

Affected products

Zscaler · Client Connector
- affected < 1.3.1.6

References (1)

https://help.zscaler.com/client-connector/client-connector-app-release-summary-2022?applicable_category=Linux&applicable_version=1.3.1&deployment_date=2022-09-19 (opens in a new tab)x_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2023-28795](https://trackcve.app/badge/CVE-2023-28795.svg)](https://trackcve.app/cve/CVE-2023-28795)

Record last updated 27 Feb 2025, 20:39 UTC.