CVE-2022-3330: 
GitLab vulnerability analysis and mitigation

A vulnerability (CVE-2022-3330) was discovered in GitLab CE/EE that allowed guest users to read todo details targeting inaccessible notes. This vulnerability affected all versions from 15.0 prior to 15.2.5, 15.3 prior to 15.3.4, and 15.4 prior to 15.4.1 (NVD).

The vulnerability has been assigned a CVSS v3.1 Base Score of 4.3 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. This indicates that the vulnerability requires low attack complexity, requires low privileges, needs no user interaction, and can lead to low confidentiality impact with no impact on integrity or availability (NVD).

The vulnerability allows unauthorized access to todo details that should be inaccessible, potentially exposing sensitive information to guest users (GitLab Release).

The vulnerability requires low attack complexity and low privileges to exploit, making it relatively accessible to attackers with basic access to the system (NVD).

The vulnerability has been patched in GitLab versions 15.2.5, 15.3.4, and 15.4.1. Users are strongly recommended to upgrade to these versions or later to mitigate the vulnerability (GitLab Release).