CVE-2022-34914

CVE-2022-34914 is a critical X-Forwarded-For header injection vulnerability affecting Webswing versions prior to 22.1.3. This flaw allows an unauthenticated attacker to manipulate the X-Forwarded-For header, injecting arbitrary values that are then used without sanitization to replace the {clientIp} variable in the configuration, potentially leading to the injection of multiple arguments into the session startup. With a CVSS score of 9.8 (Critical), this vulnerability has a network attack vector, low attack complexity, and can result in high impacts to confidentiality, integrity, and availability. There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion surrounding this CVE.