CVE-2022-3351: 
GitLab vulnerability analysis and mitigation

An issue was discovered in GitLab Enterprise Edition (EE) affecting all versions starting from 13.7 before 15.2.5, all versions starting from 15.3 before 15.3.4, and all versions starting from 15.4 before 15.4.1. The vulnerability allows a user's primary email to be disclosed to an attacker through group member events webhooks (GitLab Security, CVE Details).

The vulnerability is classified as a medium severity issue with a CVSS score of 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). The issue specifically involves the exposure of user's primary email through group member events webhooks functionality (GitLab Security).

When exploited, this vulnerability could lead to unauthorized disclosure of users' primary email addresses, potentially compromising user privacy and enabling targeted phishing attacks (GitLab Security).

GitLab has addressed this vulnerability in versions 15.4.1, 15.3.4, and 15.2.5. Users are strongly recommended to upgrade to these patched versions immediately. GitLab.com has already been updated to run the patched version (GitLab Security).

The vulnerability was responsibly disclosed through GitLab's HackerOne bug bounty program by security researcher @joaxcar (GitLab Security).