CVE-2022-3767

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Missing validation in DAST analyzer affecting all versions from 1.11.0 prior to 3.0.32, allows custom request headers to be sent with every request, regardless of the host.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
GitLab	DAST	>=1.11, <3.0.32

References

https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3767.jsonVendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/377473Exploit, Issue Tracking, Patch, Vendor Advisory
https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3767.jsonVendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/377473Exploit, Issue Tracking, Patch, Vendor Advisory

Timeline

Published: Mar 9, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-376794.8Miniblog.Core v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /blog/edit. This vulnerability allo CVE-2022-37688.8The WPSmartContracts WordPress plugin before 1.3.12 does not properly sanitise and escape a parameter before using it in a SQL statement, le CVE-2022-376807.5An improper authentication for critical function issue in Hitachi Kokusai Electric Network products for monitoring system (Camera, Decoder a CVE-2022-376817.5Hitachi Kokusai Electric Newtork products for monitoring system (Camera, Decoder and Encoder) and below allows attckers to perform a directo CVE-2022-37698.8The OWM Weather WordPress plugin before 5.6.9 does not properly sanitise and escape a parameter before using it in a SQL statement, leading CVE-2022-37708.8A vulnerability classified as critical was found in Yunjing CMS. This vulnerability affects unknown code of the file /index/user/upload_img.CVE-2022-377007.5Zentao Demo15 is vulnerable to Directory Traversal. The impact is: obtain sensitive information (remote). The component is: URL : view-sourc CVE-2022-377033.3In Amanda 3.5.1, an information leak vulnerability was found in the calcsize SUID binary. An attacker can abuse this vulnerability to know i CVE-2022-377046.7Amanda 3.5.1 allows privilege escalation from the regular user backup to root. The SUID binary located at /lib/amanda/rundump will execute /CVE-2022-377056.7A privilege escalation flaw was found in Amanda 3.5.1 in which the backup user can acquire root privileges. The vulnerable component is the CVE-2022-377067.8enlightenment_sys in Enlightenment before 0.25.4 allows local users to gain privileges because it is setuid root, and the system library fun CVE-2022-377095.3Tesla Model 3 V11.0(2022.4.5.1 6b701552d7a6) Tesla mobile app v4.23 is vulnerable to Authentication Bypass by spoofing. Tesla Model 3's Phon