{"id":"CVE-2023-41971","aliases":["EUVD-2023-46430","GHSA-h695-7mxq-qwxc"],"status":"published","title":"Windows ZCC Upgrade DoS And Privilege Escalation Through RPC Control","description":"An Improper Link Resolution Before File Access ('Link Following') vulnerability in Zscaler Client Connector on Windows allows a system file to be overwritten.This issue affects Client Connector on Windows: before 3.7.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00187,"percentile":0.08308,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-59"],"published":"2024-05-02T13:11:07Z","modified":"2026-06-17T06:23:10Z","products":[{"vendor":"zscaler","product":"client connector"},{"vendor":"zscaler","product":"client_connector"}],"references":[{"url":"https://help.zscaler.com/zscaler-client-connector/client-connector-app-release-summary-2021??applicable_category=windows\u0026applicable_version=3.7","tags":["x_transferred","Release Notes","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-41971"},{"url":"https://github.com/advisories/GHSA-h695-7mxq-qwxc"}],"sources":{"cve":[{"id":"CVE-2023-41971","title":"Windows ZCC Upgrade DoS And Privilege Escalation Through RPC Control","description":"An Improper Link Resolution Before File Access ('Link Following') vulnerability in Zscaler Client Connector on Windows allows a system file to be overwritten.This issue affects Client Connector on Windows: before 3.7.\n\n","status":"published","published":"2024-05-02T13:11:07.86Z","modified":"2024-08-06T17:51:01.988Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-59"],"updated_at":"2026-11-02T14:35:18.88314Z"}],"euvd":[{"id":"EUVD-2023-46430","description":"An Improper Link Resolution Before File Access ('Link Following') vulnerability in Zscaler Client Connector on Windows allows a system file to be overwritten.This issue affects Client Connector on Windows: before 3.7.\n\n","status":"published","published":"2024-05-02T13:11:07Z","modified":"2024-08-06T17:51:01Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H","level":"medium"}],"updated_at":"2026-11-03T01:56:25.224612Z"}],"ghsa":[{"id":"GHSA-h695-7mxq-qwxc","title":"An Improper Link Resolution Before File Access ('Link Following') vulnerability in Zscaler Client...","description":"An Improper Link Resolution Before File Access ('Link Following') vulnerability in Zscaler Client Connector on Windows allows a system file to be overwritten.This issue affects Client Connector on Windows: before 3.7.","status":"published","published":"2024-05-02T15:30:33Z","modified":"2026-03-02T21:32:28Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H","level":"medium"}],"cwes":["CWE-59"],"updated_at":"2026-11-02T15:06:25.813045Z"}],"nvd":[{"id":"CVE-2023-41971","description":"An Improper Link Resolution Before File Access ('Link Following') vulnerability in Zscaler Client Connector on Windows allows a system file to be overwritten.This issue affects Client Connector on Windows: before 3.7.\n\n","status":"published","published":"2024-05-02T13:23:06.18Z","modified":"2026-06-17T06:23:10.43Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-59"],"updated_at":"2026-11-02T14:09:11.362739Z"}]}}