CVE-2022-0136: 
GitLab vulnerability analysis and mitigation

A vulnerability was discovered in GitLab versions 10.5 to 14.5.4, 14.6 to 14.6.4, and 14.7 to 14.7.1, where GitLab was vulnerable to a blind Server-Side Request Forgery (SSRF) attack through the Project Import feature. The vulnerability was disclosed on February 3, 2022, and was assigned the identifier CVE-2022-0136 (GitLab Release, CVE Mitre).

The vulnerability was classified as a medium severity issue with a CVSS score of 5.4 (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L). The issue specifically affected the Project Import functionality in GitLab, allowing potential blind SSRF attacks (GitLab Release).

The vulnerability could potentially allow attackers to perform blind Server-Side Request Forgery attacks through the Project Import feature, potentially leading to unauthorized access to internal resources or information leakage (GitLab Release).

GitLab addressed this vulnerability in versions 14.7.1, 14.6.4, and 14.5.4. Users were strongly recommended to upgrade their GitLab installations to one of these patched versions immediately. GitLab.com was reported to be already running the patched version at the time of disclosure (GitLab Release).