CVE-2022-2501: 
GitLab vulnerability analysis and mitigation

An improper access control vulnerability (CVE-2022-2501) was discovered in GitLab Enterprise Edition affecting all versions from 12.0 prior to 15.0.5, 15.1 prior to 15.1.4, and 15.2 prior to 15.2.1. The vulnerability allows attackers to bypass IP allow-listing and download artifacts, though proper permissions are still required for access (NVD, GitLab Release).

The vulnerability has been assigned a CVSS v3.1 base score of 5.9 (Medium) by GitLab Inc. with vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N, while NIST assigned a score of 7.5 (High) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. The vulnerability is classified as CWE-863 (Incorrect Authorization) (NVD).

The vulnerability allows attackers to bypass IP allow-listing restrictions when accessing job artifacts through GitLab Pages. However, the impact is limited as proper permissions are still required to access the artifacts (GitLab Release).

GitLab has addressed this vulnerability in versions 15.0.5, 15.1.4, and 15.2.1. Users are strongly recommended to upgrade to these patched versions immediately. GitLab.com has already been updated with the security fix (GitLab Release).