CVE-2022-34914

Webswing before 22.1.3 allows X-Forwarded-For header injection. The client IP address is associated with a variable in the configuration page. The {clientIp} variable can be used as an application startup argument. The X-Forwarded-For header can be manipulated by a client to store an arbitrary value that is used to replace the clientIp variable (without sanitization). A client can thus inject multiple arguments into the session startup. Systems that do not use the clientIP variable in the configuration are not vulnerable. The vulnerability is fixed in these versions: 20.1.16, 20.2.19, 21.1.8, 21.2.12, and 22.1.3.

• CWE-74

• https://www.webswing.org/blog/header-injection-vulnerability-cve-2022-34914Vendor Advisory
• https://www.webswing.org/docs/20.1/faq/client_ip.htmlVendor Advisory
• https://www.webswing.org/blog/header-injection-vulnerability-cve-2022-34914Vendor Advisory
• https://www.webswing.org/docs/20.1/faq/client_ip.htmlVendor Advisory

Published

Jul 8, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-34909An issue was discovered in the A4N (Aremis 4 Nomad) applicat…9.1
• CVE-2022-3491Heap-based Buffer Overflow in GitHub repository vim/vim prio…7.8
• CVE-2022-34910An issue was discovered in the A4N (Aremis 4 Nomad) applicat…5.5
• CVE-2022-34911An issue was discovered in MediaWiki before 1.35.7, 1.36.x a…6.1
• CVE-2022-34912An issue was discovered in MediaWiki before 1.37.3 and 1.38.…6.1
• CVE-2022-34913md2roff 1.7 has a stack-based buffer overflow via a Markdown…9.8
• CVE-2022-34916Apache Flume versions 1.4.0 through 1.10.0 are vulnerable to…9.8
• CVE-2022-34917A security vulnerability has been identified in Apache Kafka…7.5
• CVE-2022-34918An issue was discovered in the Linux kernel through 5.18.9. …7.8
• CVE-2022-34919The file upload wizard in Zengenti Contensis Classic before …9.8
• CVE-2022-3492A vulnerability classified as critical was found in SourceCo…8.8
• CVE-2022-34924Lanling OA Landray Office Automation (OA) internal patch num…7.5