CVE-2022-3767: GitLab Dynamic Application Security Testing Analyzer

Medium severity, CVSS 6.5. EPSS: 0.8% chance of exploitation in the next 30 days.

Missing validation in DAST analyzer affecting all versions from 1.11.0 prior to 3.0.32, allows custom request headers to be sent with every request, regardless of the host.

Affected products

• GitLab Dynamic Application Security Testing Analyzer: from 1.11.0, before 3.0.32 (fixed in 3.0.32)

Published 2023-03-09. Last modified 2026-06-17.