CVE-2022-3767

Missing validation in DAST analyzer affecting all versions from 1.11.0 prior to 3.0.32, allows custom request headers to be sent with every request, regardless of the host.

Score

CVSS 3.1 7.7 High

Status

Modified - cve@gitlab.com

Published

2023-03-09

Last modified

2025-02-28

Weaknesses

CWE-20

Affected products

• Dast (Gitlab)
• Dynamic Application Security Testing Analyzer (Gitlab)

References

• https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3767.json
• https://gitlab.com/gitlab-org/gitlab/-/issues/377473