CVE-2023-28807

In Zscaler Internet Access (ZIA) a mismatch between Connect Host and Client Hello's Server Name Indication (SNI) enables attackers to evade network security controls by hiding their communications within legitimate traffic.
Configurations

Configuration 1 (hide)

cpe:2.3:a:zscaler:secure_internet_and_saas_access:*:*:*:*:*:*:*:*

History

09 Feb 2024, 16:30

Type Values Removed Values Added
CPE cpe:2.3:a:zscaler:secure_internet_and_saas_access:*:*:*:*:*:*:*:*
References () https://help.zscaler.com/zia/configuring-advanced-settings#dns-optimization - () https://help.zscaler.com/zia/configuring-advanced-settings#dns-optimization - Product
References () https://help.zscaler.com/zia/configuring-advanced-settings#domain-fronting - () https://help.zscaler.com/zia/configuring-advanced-settings#domain-fronting - Product
First Time Zscaler secure Internet And Saas Access
Zscaler
CVSS v2 : unknown
v3 : 5.1
v2 : unknown
v3 : 7.5

31 Jan 2024, 20:15

Type Values Removed Values Added
New CVE

Information

Published : 2024-01-31 20:15

Updated : 2024-02-09 16:30


NVD link : CVE-2023-28807

Mitre link : CVE-2023-28807

CVE.ORG link : CVE-2023-28807


JSON object : View

Products Affected

zscaler

  • secure_internet_and_saas_access
CWE
CWE-295

Improper Certificate Validation