CVE-2022-2307: 
GitLab vulnerability analysis and mitigation

A lack of cascading deletes vulnerability was discovered in GitLab CE/EE affecting all versions starting from 13.0 before 15.0.5, all versions starting from 15.1 before 15.1.4, and all versions starting from 15.2 before 15.2.1. The vulnerability allows a malicious Group Owner to retain a usable Group Access Token even after the Group is deleted, though the APIs usable by that token are limited (GitLab Security Release, NVD).

The vulnerability has been assigned CVE-2022-2307 and received a CVSS v3.1 Base Score of 3.5 LOW with a vector of CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N. The issue stems from incomplete cleanup processes in GitLab's group deletion functionality, specifically related to the handling of Group Access Tokens (NVD).

When exploited, this vulnerability allows malicious Group Owners to maintain access to certain APIs through a Group Access Token even after the associated Group has been deleted. However, the scope of accessible APIs through these retained tokens is limited (GitLab Security Release).

The vulnerability has been fixed in GitLab versions 15.0.5, 15.1.4, and 15.2.1. Users are strongly recommended to upgrade to one of these patched versions immediately (GitLab Security Release).

The vulnerability was discovered internally by the JiHu team and was addressed as part of GitLab's regular security release cycle (GitLab Security Release).