CVE-2022-3820: 
GitLab vulnerability analysis and mitigation

An issue was discovered in GitLab affecting all versions starting from 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2. The vulnerability involved GitLab not performing correct authentication with some Package Registries when IP address restrictions were configured, allowing an attacker already in possession of a valid Deploy Token to misuse it from any location (GitLab Security Release).

The vulnerability was classified as a medium severity issue with a CVSS score of 6.5 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N). The issue specifically pertained to the Group IP allow-list functionality not being fully respected by the Package Registry, creating an authentication bypass scenario (GitLab Security Release).

The vulnerability allowed attackers with a valid Deploy Token to bypass IP address restrictions, potentially accessing Package Registries from unauthorized locations. This circumvention of security controls could lead to unauthorized access to protected resources (GitLab Security Release).

The vulnerability was patched in GitLab versions 15.4.4, 15.5.2, and later releases. Organizations were strongly recommended to upgrade to these or newer versions immediately to address the security issue (GitLab Security Release).

The vulnerability was discovered internally by the GitLab team and was handled through their security release process. GitLab.com was promptly updated to run the patched version to protect users (GitLab Security Release).