CVE-2022-3758: 
GitLab vulnerability analysis and mitigation

An issue was discovered in GitLab affecting all versions starting from 15.5 before 15.7.8, all versions starting from 15.8 before 15.8.4, and all versions starting from 15.9 before 15.9.2. Due to improper permissions checks, an unauthorized user was able to read, add or edit a user's private snippet (GitLab Advisory, NVD).

The vulnerability is tracked as CVE-2022-3758 and has been assigned a CVSS v3.1 Base Score of 5.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N. The issue is classified under CWE-276 (Incorrect Default Permissions) and affects both GitLab Community and Enterprise editions (NVD).

The vulnerability allows unauthorized users to access, create, and modify private snippets belonging to other users. Additionally, attackers can obtain the titles of private snippets and potentially iterate through sequential snippet IDs to discover other private snippet titles (GitLab Advisory).

The vulnerability has been fixed in GitLab versions 15.7.8, 15.8.4, and 15.9.2. Users are strongly recommended to upgrade to these or later versions immediately. GitLab.com has already been patched with the security fix (GitLab Advisory).

The vulnerability was responsibly disclosed through GitLab's HackerOne bug bounty program by security researcher cryptopone. GitLab addressed the issue in their March 2023 security release, classifying it as a medium severity vulnerability (GitLab Advisory).