CVE-2021-41388
High
Description
Netskope client prior to 89.x on macOS is impacted by a local privilege escalation vulnerability. The XPC implementation of nsAuxiliarySvc process does not perform validation on new connections before accepting the connection. Thus any low privileged user can connect and call external methods defined in XPC service as root, elevating their privilege to the highest level.
SeverityHigh
CVSS7.8
Exploit probability—
ProductNetskope
PublishedJan 4, 2022
First seenJan 4, 2022
How to fix
Update
- netskope netskope89 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| netskope netskope | v < 89 | 89 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.