PT-2022-6116 · Owasp · Owasp Zed Attack Proxy

Gabriel Corona · Published 2022-03-24 · Updated 2022-03-31 · CVE-2022-27820

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions OWASP Zed Attack Proxy versions through w2022-03-21

Description The issue is related to incorrect authentication of a certificate in the web application security scanner. It may allow a remote attacker to compromise the integrity of protected information. The problem lies in the failure to verify the TLS certificate chain of an HTTPS server.

Recommendations For OWASP Zed Attack Proxy versions through w2022-03-21, update to a version that verifies the TLS certificate chain of an HTTPS server to prevent exploitation. As a temporary workaround, consider restricting the use of the scanner until a patch is available.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

BDU:2023-00056

CVE-2022-27820

GHSA-J7XG-5549-JR3J

Affected Products

Owasp Zed Attack Proxy

References · 9

• https://osv.dev/vulnerability/GHSA-j7xg-5549-jr3j · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-00056 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-27820 · Security Note
• https://osv.dev/vulnerability/CVE-2022-27820 · Vendor Advisory
• https://github.com/zaproxy/zaproxy/releases · Note
• https://github.com/zaproxy/zaproxy/issues/7165 · Note
• http://openwall.com/lists/oss-security/2022/03/24/3 · Note
• https://openwall.com/lists/oss-security/2022/03/23/1 · Note
• https://t.me/cvenotify/28229 · Telegram Post