CVE-2022-4317 Open redirect in DAST

Medium 5.0 Published 9 Mar 2023 Updated 28 Feb 2025

GitLab DAST analyzer sends custom headers during redirects, potentially allowing attackers to bypass security controls or leak sensitive information.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2022-4317?

CVE-2022-4317 is a medium-severity vulnerability in GitLab DAST, published on 9 Mar 2023. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

An issue has been discovered in GitLab DAST analyzer affecting all versions starting from 1.47 before 3.0.51, which sends custom request headers in redirects.

Weakness: CWE-601

Which versions are affected by CVE-2022-4317?

It affects 1 product.

Products include Gitlab Dynamic Application Security Testing Analyzer.

How do I fix CVE-2022-4317?

No fix has been published for CVE-2022-4317 yet. Limit exposure of the affected software until one is available.

Is CVE-2022-4317 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-4317 exists.

Sources

Also known as GHSA-4mvf-qm8g-c6mp.