CVE-2023-41972
Revert password check incorrect type validation
Severity Score
7.3
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
Track*
*SSVC
Descriptions
In some rare cases, there is a password type validation missing in Revert Password check and for some features it could be disabled. Fixed Version: Win ZApp 4.3.0.121 and later.
En algunos casos excepcionales, falta una validación del tipo de contraseña en la verificación de revertir contraseña y, para algunas funciones, podría estar deshabilitada. Versión fija: Win ZApp 4.3.0.121 y posteriores.
*Credits:
Singapore GovTech Red Team
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:Track*
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2023-09-06 CVE Reserved
- 2024-03-26 CVE Published
- 2024-03-27 EPSS Updated
- 2024-10-17 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-269: Improper Privilege Management
- CWE-280: Improper Handling of Insufficient Permissions or Privileges
CAPEC
- CAPEC-233: Privilege Escalation
References (1)
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Zscaler Search vendor "Zscaler" | Client Connector Search vendor "Zscaler" for product "Client Connector" | < 4.3.0.121 Search vendor "Zscaler" for product "Client Connector" and version " < 4.3.0.121" | en |
Affected
| ||||||