Improper Certificate Validation in OWASP ZAP

MÉDIO 4.0CVE-2022-27820 · GHSA-j7xg-5549-jr3j · Published 24/03/2022 · updated 17/06/2026

Em resumo

CVE-2022-27820 é uma vulnerabilidade MÉDIO (CVSS 4.0) que afeta org.zaproxy:zap, zed attack proxy (owasp).
Chance de exploração nos próximos 30 dias (EPSS): 0.68%, maior que 52.4% das vulnerabilidades.
Ainda não há versão corrigida: acompanhe o aviso do fornecedor em Referências.

Package	Affected versions	Patched versions
org.zaproxy:zap Maven	`≤ 2.11.1`	No fix yet
zed attack proxy owasp	`≤ w2022-03-21`	No fix yet

OWASP Zed Attack Proxy (ZAP) through w2022-03-21 does not verify the TLS certificate chain of an HTTPS server.

NVD description

OWASP Zed Attack Proxy (ZAP) through w2022-03-21 does not verify the TLS certificate chain of an HTTPS server.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.