Vulnerability Description
Missing validation in DAST analyzer affecting all versions from 1.11.0 prior to 3.0.32, allows custom request headers to be sent with every request, regardless of the host.
CVSS Score
7.7
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Gitlab | Dynamic Application Security Testing Analyzer | >= 1.11.0, < 3.0.32 |
Related Weaknesses (CWE)
References
- https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3767.jsonVendor Advisory
- https://gitlab.com/gitlab-org/gitlab/-/issues/377473ExploitIssue TrackingPatch
- https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3767.jsonVendor Advisory
- https://gitlab.com/gitlab-org/gitlab/-/issues/377473ExploitIssue TrackingPatch
FAQ
What is CVE-2022-3767?
CVE-2022-3767 is a vulnerability with a CVSS score of 7.7 (HIGH). Missing validation in DAST analyzer affecting all versions from 1.11.0 prior to 3.0.32, allows custom request headers to be sent with every request, regardless of the host.
How severe is CVE-2022-3767?
CVE-2022-3767 has been rated HIGH with a CVSS base score of 7.7/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2022-3767?
Check the references section above for vendor advisories and patch information. Affected products include: Gitlab Dynamic Application Security Testing Analyzer.