CVE-2022-4317

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

An issue has been discovered in GitLab DAST analyzer affecting all versions starting from 1.47 before 3.0.51, which sends custom request headers in redirects.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-601

Affected software

Vendor	Product	Versions
GitLab	DAST	>=1.47, <3.0.51

References

https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-4317.jsonVendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/384997Exploit, Vendor Advisory
https://hackerone.com/reports/1767533Permissions Required
https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-4317.jsonVendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/384997Exploit, Vendor Advisory
https://hackerone.com/reports/1767533Permissions Required

Timeline

Published: Mar 9, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-431705.4A stored cross-site scripting (XSS) vulnerability in the Dashboard Configuration feature (index.php?module=dashboard_configure/index) of Ruk CVE-2022-431716.5A heap buffer overflow in the LIEF::MachO::BinaryParser::parse_dyldinfo_generic_bind function of LIEF v0.12.1 allows attackers to cause a De CVE-2022-431797.2Online Leave Management System v1.0 was discovered to contain a SQL injection vulnerability via the component /admin/?page=user/manage_user&CVE-2022-43187.8A vulnerability was found in cri-o. This issue allows the addition of arbitrary lines into /etc/passwd by use of a specially crafted environ CVE-2022-431838.8XXL-Job before v2.3.1 contains a Server-Side Request Forgery (SSRF) via the component /admin/controller/JobLogController.java.CVE-2022-431849.8D-Link DIR878 1.30B08 Hotfix_04 was discovered to contain a command injection vulnerability via the component /bin/proc.cgi.CVE-2022-431855.4A stored cross-site scripting (XSS) vulnerability in the Configuration/Holidays module of Rukovoditel v3.2.1 allows attackers to execute arb CVE-2022-431926.7An arbitrary file upload vulnerability in the component /dede/file_manage_control.php of Dedecms v5.7.101 allows attackers to execute arbitr CVE-2022-431969.1dedecmdv6 v6.1.9 is vulnerable to Arbitrary file deletion via file_manage_control.php.CVE-2022-43206.1The WordPress Events Calendar WordPress plugin before 1.4.5 does not sanitize and escapes a parameter before outputting it back in the page,CVE-2022-43216.1The PDF Generator for WordPress plugin before 1.1.2 includes a vendored dompdf example file which is susceptible to Reflected Cross-Site Scr CVE-2022-432129.8Billing System Project v1.0 was discovered to contain a SQL injection vulnerability via the orderId parameter at fetchOrderData.php.