CVE-2022-4054: 
GitLab vulnerability analysis and mitigation

An issue was discovered in GitLab affecting all versions starting from 9.3 before 15.4.6, all versions starting from 15.5 before 15.5.5, and all versions starting from 15.6 before 15.6.1. The vulnerability allowed project maintainers to leak webhook secret tokens by changing the webhook URL to an endpoint that could capture request headers (GitLab Advisory, NVD).

The vulnerability has been assigned a CVSS v3.1 Base Score of 5.5 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N. The issue stems from the webhook functionality where secret tokens, which should remain hidden from maintainers after being saved, could be exposed by modifying the webhook URL to capture request headers (GitLab Advisory).

The vulnerability allows project maintainers to discover secret webhook tokens that should remain hidden after configuration. This exposure could potentially lead to unauthorized access to webhook communications and compromise the security of webhook integrations (GitLab Issue).

The vulnerability has been fixed in GitLab versions 15.4.6, 15.5.5, and 15.6.1. Organizations are strongly recommended to upgrade to one of these patched versions immediately. GitLab.com has already been updated with the patched version (GitLab Advisory).