CVE-2024-13177: Symlink Following in Netskope Client Postinstall Script

Severity: medium (CVSS 5.2 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-04-15 · updated 2026-06-17
Weakness: CWE-610

Description

Netskope Client on Mac OS is impacted by a vulnerability in which the postinstall script does not properly validate the path of the file “nsinstallation”. A standard user could potentially create a symlink of the file “nsinstallation” to escalate the privileges of a different file on the system. This issue affects Netskope Client: before 123.0, before 117.1.11.2310, before 120.1.10.2306.

Affected products

Netskope Client: before 123.0; before 117.1.11.2310; before 120.1.10.2306 — fixed in 117.1.11.2310, 120.1.10.2306, 123.0

How to fix

Upgrade to a fixed version: Netskope Client 117.1.11.2310, 120.1.10.2306, 123.0. Check the vendor advisory for mitigations.

References

https://support.netskope.com/s/article/Netskope-Security-Advisory-Netskope-Client-installer-with-symbolic-link-following-vulnerability-leading-to-privilege-escalation

Get alerted when CVE-2024-13177 or the next vulnerability affects your stack