Improper Certificate Validation in OWASP ZAP

MEDIO 4.0CVE-2022-27820 · GHSA-j7xg-5549-jr3j · Published 24/03/2022 · updated 17/06/2026

In breve

CVE-2022-27820 è una vulnerabilità MEDIO (CVSS 4.0) che riguarda org.zaproxy:zap, zed attack proxy (owasp).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.68%, superiore al 52.4% delle vulnerabilità.
Nessuna versione corretta ancora nota: segui l'avviso del produttore nei riferimenti.

Package	Affected versions	Patched versions
org.zaproxy:zap Maven	`≤ 2.11.1`	No fix yet
zed attack proxy owasp	`≤ w2022-03-21`	No fix yet

OWASP Zed Attack Proxy (ZAP) through w2022-03-21 does not verify the TLS certificate chain of an HTTPS server.

NVD description

OWASP Zed Attack Proxy (ZAP) through w2022-03-21 does not verify the TLS certificate chain of an HTTPS server.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.