CVE-2022-3291: 
GitLab vulnerability analysis and mitigation

A serialization vulnerability (CVE-2022-3291) was discovered in GitLab Enterprise Edition (EE) affecting versions from 14.9 prior to 15.2.5, 15.3 prior to 15.3.4, and 15.4 prior to 15.4.1. The vulnerability was discovered internally by the GitLab team and disclosed on September 29, 2022 (GitLab Release).

The vulnerability involves unsafe serialization of JSON data that could potentially lead to sensitive information leakage via cache. The issue has been assigned a CVSS v3.1 base score of 6.5 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N (GitLab Release).

The vulnerability could result in the leakage of sensitive information through cache mechanisms. The high confidentiality impact rating in the CVSS score indicates that the vulnerability could lead to significant disclosure of sensitive data (GitLab Release).

The vulnerability has been fixed in GitLab versions 15.2.5, 15.3.4, and 15.4.1. Users are strongly recommended to upgrade to these patched versions immediately. GitLab.com was already running the patched version at the time of disclosure (GitLab Release).