TI-2024-12223 Aliases CVE-2024-13177 GHSA-6x8p-pjfm-rgxq

Symlink Following in Netskope Client Postinstall Script

LOW 23CWE-610Published 2025-04-15 · Updated 2025-04-15

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: High
Attack requirements: None
Impact type: —
Confidentiality · integrity · availability: None · None · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Netskope Client on Mac OS is impacted by a vulnerability in which the postinstall script does not properly validate the path of the file “nsinstallation”. A standard user could potentially create a symlink of the file “nsinstallation” to escalate the privileges of a different file on the system. This issue affects Netskope Client: before 123.0, before 117.1.11.2310, before 120.1.10.2306.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.0015 4th percentileScored 2026-11-07

Fix Fixed Netskope Client (Netskope): 123.0, 117.1.11.2310, 120.1.10.2306

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Netskope	Netskope Client	before 123.0; before 117.1.11.2310; before 120.1.10.2306	123.0, 117.1.11.2310, 120.1.10.2306	Patch available	CNA

Netskope Client VendorNetskope Affected before 123.0; before 117.1.11.2310; before 120.1.10.2306 Fixed in 123.0, 117.1.11.2310, 120.1.10.2306 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:netskope:netskope::::::::	—	—	Netskope

cpe:2.3:a:netskope:netskope:*:*:*:*:*:*:*:* Versions — — ·Netskope

Remediation

Fix · CNA Netskope Client (Netskope) Fixed in 123.0, 117.1.11.2310, 120.1.10.2306

Timeline

2026-10-02 Threatist record created from CVE-2024-13177
2026-10-03 Alias added: GHSA-6x8p-pjfm-rgxq

References

Other 1

https://support.netskope.com/s/article/Netskope-Security-Advisory-Netskope-Client-installer-with-symbolic-link-following-vulnerability-leading-to-privilege-escalation

TI-2020-15056 Netskope Client through 77 allows low-privileged users to elevate their privileges to NT AUTHORITY\SYSTEM. CVSS 3.1HIGH 8.8
TI-2026-13525 Netskope Endpoint DLP Driver Integer Overflow Leading to Kernel Pool Overflow CVSS 4.0HIGH 8.7
TI-2024-06860 Client Enrollment Process Bypass CVSS 4.0HIGH 8.5
TI-2023-04599 Local privilege escalation in Netskope Client CVSS 3.1HIGH 8.8
TI-2021-20302 Sensitive Information store in NSClient logs CVSS 3.1HIGH 8.4
TI-2023-02129 Local privilege escalation in Netskope Client CVSS 3.1HIGH 7.8

See all 25 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences