CVE-2022-3767

CVSS 7.7 HIGHEPSS 0.7%CWE-20

Vexday Risk Score

21Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 7.7EPSS 0.7%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

09 Mar 2023Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

Missing validation in DAST analyzer affecting all versions from 1.11.0 prior to 3.0.32, allows custom request headers to be sent with every request, regardless of the host.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Affected products

GitLab · DAST

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3767.json https://gitlab.com/gitlab-org/gitlab/-/issues/377473