CVE-2022-1120: 
GitLab vulnerability analysis and mitigation

Missing filtering in an error message in GitLab CE/EE affecting all versions prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 exposed sensitive information when an include directive fails in the CI/CD configuration (GitLab Release, NVD).

The vulnerability is tracked as CVE-2022-1120 and has been assigned a CVSS v3.1 Base Score of 6.5 MEDIUM (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) by NVD, while GitLab Inc. assessed it as 4.8 MEDIUM (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N). The vulnerability is classified under CWE-209 (Generation of Error Message Containing Sensitive Information) (NVD).

When exploited, this vulnerability could lead to the exposure of sensitive information, particularly masked CI variables, when an include directive fails in the CI/CD configuration (GitLab Release).

The vulnerability has been fixed in GitLab versions 14.7.7, 14.8.5, and 14.9.2. It is strongly recommended that all GitLab installations be upgraded to one of these versions immediately (GitLab Release).

The vulnerability was reported through GitLab's HackerOne bug bounty program by bdrich, indicating active participation from the security research community in identifying and responsibly disclosing GitLab vulnerabilities (GitLab Release).