CVE-2022-3767

Опубликовано: 09 мар. 2023

Источник: nvd

CVSS3: 7.7

CVSS3: 6.5

EPSS Низкий

Описание

Missing validation in DAST analyzer affecting all versions from 1.11.0 prior to 3.0.32, allows custom request headers to be sent with every request, regardless of the host.

Ссылки

https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3767.json
Vendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/377473
Exploit
Issue Tracking
Patch
Vendor Advisory
https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3767.json
Vendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/377473
Exploit
Issue Tracking
Patch
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:gitlab:dynamic_application_security_testing_analyzer:*:*:*:*:*:*:*:*

Версия от 1.11.0 (включая) до 3.0.32 (исключая)

EPSS

Процентиль: 42%

0.00199

Низкий

7.7 High

CVSS3

6.5 Medium

CVSS3

Дефекты

NVD-CWE-noinfo

CWE-20

Связанные уязвимости

CVE-2022-3767

CVSS3: 7.7

ubuntu

почти 3 года назад

Missing validation in DAST analyzer affecting all versions from 1.11.0 prior to 3.0.32, allows custom request headers to be sent with every request, regardless of the host.

CVE-2022-3767

CVSS3: 7.7

debian

почти 3 года назад

Missing validation in DAST analyzer affecting all versions from 1.11.0 ...

GHSA-5xvv-4r9w-mw22

CVSS3: 6.5

github

почти 3 года назад

Missing validation in DAST analyzer affecting all versions from 1.11.0 prior to 3.0.32, allows custom request headers to be sent with every request, regardless of the host.

EPSS

Процентиль: 42%

0.00199

Низкий

7.7 High

CVSS3

6.5 Medium

CVSS3

Дефекты

NVD-CWE-noinfo

CWE-20