CVE-2022-27820

Name of the Vulnerable Software and Affected Versions OWASP Zed Attack Proxy versions through w2022-03-21

Description The issue is related to incorrect authentication of a certificate in the web application security scanner. It may allow a remote attacker to compromise the integrity of protected information. The problem lies in the failure to verify the TLS certificate chain of an HTTPS server.

Recommendations For OWASP Zed Attack Proxy versions through w2022-03-21, update to a version that verifies the TLS certificate chain of an HTTPS server to prevent exploitation. As a temporary workaround, consider restricting the use of the scanner until a patch is available.