CVE-2022-3286: 
GitLab vulnerability analysis and mitigation

A security vulnerability identified as CVE-2022-3286 was discovered in GitLab Enterprise Edition (EE). The vulnerability affects all versions from 14.2 prior to 15.2.5, 15.3 prior to 15.3.4, and 15.4 prior to 15.4.1. The issue involves a lack of IP address checking that allows group members to bypass IP restrictions when using a deploy token (GitLab Release).

The vulnerability has been assigned a CVSS v3.1 Base Score of 5.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. The issue specifically affects the Dependency Proxy functionality in GitLab EE, where the IP address checking mechanism fails to properly validate restrictions when deploy tokens are used (NVD).

The vulnerability allows group members to circumvent IP-based access restrictions when utilizing deploy tokens to access the Dependency Proxy. This bypass of security controls could potentially lead to unauthorized access from restricted IP addresses (GitLab Release).

The vulnerability can be exploited by authenticated users who are group members with access to deploy tokens. The attack requires network access but does not need any user interaction or special access privileges beyond group membership (NVD).

The vulnerability has been fixed in GitLab versions 15.2.5, 15.3.4, and 15.4.1. Organizations running affected versions should upgrade to the patched versions immediately. GitLab.com has already been updated with the security fix (GitLab Release).