CVE-2022-4315

Published: Mar 8, 2023Modified: Jun 17, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

An issue has been discovered in GitLab DAST analyzer affecting all versions starting from 2.0 before 3.0.55, which sends custom request headers with every request on the authentication page.

Affected (1)

Products: Gitlab: Dynamic Application Security Testing Analyzer

Gitlab

1 product

Dynamic Application Security Testing Analyzer

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Gitlab Dynamic Application Security Testing Analyzer	From 2.0.0 to 3.0.55

Related CWEs

CWE-863

Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.

References (6)

https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-4315.json

Source: cve@gitlab.com

Vendor Advisory

https://gitlab.com/gitlab-org/gitlab/-/issues/384995

Source: cve@gitlab.com

ExploitVendor Advisory

https://hackerone.com/reports/1767525

Source: cve@gitlab.com

Permissions Required

https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-4315.json

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://gitlab.com/gitlab-org/gitlab/-/issues/384995

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitVendor Advisory

https://hackerone.com/reports/1767525

Source: af854a3a-2127-422b-91ae-364da2661108

Permissions Required

Timeline

No history available yet.