CVE-2022-1030: 
ScaleFT vulnerability analysis and mitigation

Okta Advanced Server Access Client for Linux and macOS prior to version 1.58.0 was identified with a command injection vulnerability (CVE-2022-1030). The vulnerability was discovered and disclosed on March 21, 2022, affecting the client software's URL handling mechanism (Okta Advisory).

The vulnerability allows command injection through a specially crafted URL. It has been assigned a CVSS v3.1 base score of 8.8 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The vulnerability is classified as CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (NVD).

If successfully exploited, an attacker who has knowledge of a valid team name for the victim and knows a valid target host where the user has access can execute arbitrary commands on the local system. This could lead to complete system compromise with the privileges of the running client (Okta Advisory).

The vulnerability has been fixed in Okta Advanced Server Access Client version 1.58.0 for both Linux and macOS platforms. Users are advised to upgrade their client software to this version or later to remediate the vulnerability (Okta Advisory).