CVE-2022-3375: 
GitLab vulnerability analysis and mitigation

An issue was discovered in GitLab affecting all versions starting from 11.10 before 15.8.5, all versions starting from 15.9 before 15.9.4, and all versions starting from 15.10 before 15.10.1. The vulnerability allowed the disclosure of branch names when an attacker had a fork of a project that was switched to private (GitLab Release).

The vulnerability has been assigned a CVSS v3.1 base score of 3.1 (LOW) with the vector string CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N. The issue stems from improper access control checks in the push options handler service, which failed to verify if the user had proper access to the project repository before revealing branch information (NVD).

The vulnerability allows attackers to enumerate branch names of any private or restricted project if they have access to a fork of that project. This information disclosure could potentially reveal sensitive information about the project's structure and development workflow (GitLab Release).

The vulnerability has been fixed in GitLab versions 15.8.5, 15.9.4, and 15.10.1. Organizations running affected versions should upgrade to one of these patched versions immediately to mitigate the risk (GitLab Release).