CVE-2022-1935: 
GitLab vulnerability analysis and mitigation

Incorrect authorization vulnerability (CVE-2022-1935) was discovered in GitLab EE affecting multiple versions: all versions from 12.0 before 14.9.5, versions from 14.10 before 14.10.4, and versions from 15.0 before 15.0.1. The vulnerability was disclosed on June 1, 2022, and allows attackers with a valid Project Trigger Token to bypass IP address restrictions (GitLab Security, NVD).

The vulnerability has been assigned a CVSS v3.1 base score indicating network vector (AV:N), low attack complexity (AC:L), low privileges required (PR:L), no user interaction needed (UI:N), unchanged scope (S:U), no impact on confidentiality (C:N), high impact on integrity (I:H), and no impact on availability (A:N). The vulnerability is categorized under CWE-863, which relates to incorrect authorization (NVD).

The vulnerability allows an attacker who possesses a valid Project Trigger Token to misuse it from any location, effectively bypassing configured IP address restrictions. This creates a significant security risk as it undermines the intended network access controls (CVE).

The vulnerability has been fixed in GitLab versions 14.9.5, 14.10.4, and 15.0.1. Users are advised to upgrade to these or later versions to address the security issue (Debian Security).