CVE-2021-22228: 
GitLab vulnerability analysis and mitigation

An issue was discovered in GitLab affecting all versions before 13.11.6, all versions starting from 13.12 before 13.12.6, and all versions starting from 14.0 before 14.0.2. The vulnerability allows unauthorized users to access project details using GraphQL due to improper access control implementation (GitLab CVE, NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 6.5 (Medium), with the following vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. The vulnerability stems from improper access control in the GraphQL API implementation, where authentication and authorization checks were not properly enforced (Ubuntu CVE).

The vulnerability allows unauthorized users to access sensitive project details through GraphQL queries. This could lead to unauthorized information disclosure of private project information. The confidentiality impact is rated as High, while there are no direct impacts on integrity or availability of the system (NVD).

Users should upgrade to GitLab version 13.11.6, 13.12.6, or 14.0.2 or later, depending on their current version. These releases contain the necessary fixes to address the improper access control vulnerability (GitLab Issue).