Professional / Community 2022.11.2

Summary: PortSwigger released Burp Suite Professional/Community 2022.11.2 on 25 November 2022, moving all User and Project options into a new Settings dialog accessible from the main toolbar or a configurable hotkey. The release also added DOM Invader detection of cross-domain web message leaks, an option to strip the Permissions-Policy header, WebSocket message interception via the Montoya API, and an upgrade to Chromium 107.0.5304.110.
Key Takeaway: DOM Invader can now flag pages that send URL-derived data to a different target origin, a pattern the release says can let an attacker steal sensitive data such as OAuth tokens by embedding the page in an iframe with an event listener.

Read the original at PortSwigger Research ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026