Vulnerability Details CVE-2023-28807
In Zscaler Internet Access (ZIA) a mismatch between Connect Host and Client Hello's Server Name Indication (SNI) enables attackers to evade network security controls by hiding their communications within legitimate traffic.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.0
EPSS Ranking 10.7%
CVSS Severity
CVSS v3 Score 5.1
References
- https://help.zscaler.com/zia/configuring-advanced-settings#dns-optimization
- https://help.zscaler.com/zia/configuring-advanced-settings#domain-fronting
- https://help.zscaler.com/zia/configuring-advanced-settings#dns-optimization
- https://help.zscaler.com/zia/configuring-advanced-settings#domain-fronting
Products affected by CVE-2023-28807
-
cpe:2.3:a:zscaler:secure_internet_and_saas_access:*