CVE-2022-2270: 
GitLab vulnerability analysis and mitigation

An issue was discovered in GitLab affecting all versions starting from 12.4 before 14.10.5, all versions starting from 15.0 before 15.0.4, and all versions starting from 15.1 before 15.1.1. The vulnerability involved GitLab leaking Conan packages names due to incorrect permissions verification (GitLab Advisory, CVE Mitre).

The vulnerability was assigned a CVSS v3.1 score of 3.5 (Low severity) with the vector AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N. The issue specifically related to unauthorized access to Conan package names in GitLab's package registry system, where users with insufficient permissions could list Conan packages available in the registry (GitLab Advisory).

The vulnerability allowed unauthorized users to enumerate and view Conan package names in private registries, even when they lacked the necessary access permissions. This information disclosure could potentially reveal sensitive information about the packages used in private repositories (GitLab Issue).

The vulnerability was patched in GitLab versions 14.10.5, 15.0.4, and 15.1.1. Users are strongly recommended to upgrade to these or later versions to address the security issue (GitLab Advisory).