Improper Certificate Validation in OWASP ZAP

2022-03-2500:00:34

Google

osv.dev

0.001 Low

EPSS

Percentile

31.0%

JSON

OWASP Zed Attack Proxy (ZAP) through w2022-03-21 does not verify the TLS certificate chain of an HTTPS server.

CPENameOperatorVersion
org.zaproxy:zapeq2.7.0
org.zaproxy:zapeq2.6.0
org.zaproxy:zapeq2.5.0
org.zaproxy:zapeq2.11.1
org.zaproxy:zapeq2.10.0
org.zaproxy:zapeq2.11.0
org.zaproxy:zapeq2.9.0
org.zaproxy:zapeq2.8.0

Name	Operator	Version
org.zaproxy:zap	eq	2.7.0
org.zaproxy:zap	eq	2.6.0
org.zaproxy:zap	eq	2.5.0
org.zaproxy:zap	eq	2.11.1
org.zaproxy:zap	eq	2.10.0
org.zaproxy:zap	eq	2.11.0
org.zaproxy:zap	eq	2.9.0
org.zaproxy:zap	eq	2.8.0