CVE-2022-4255: 
GitLab vulnerability analysis and mitigation

An information leak vulnerability (CVE-2022-4255) was identified in GitLab Enterprise Edition (EE) affecting versions from 13.7 prior to 15.4.6, 15.5 prior to 15.5.5, and 15.6 prior to 15.6.1. The vulnerability exposes user email IDs through webhook payloads (GitLab Release, CVE Mitre).

The vulnerability was discovered internally by the GitLab team and is classified as a medium severity issue with a CVSS score of 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). The issue specifically relates to the group Webhook event functionality introduced for premium users in version 13.7, where webhook requests contain users' primary (hidden) email addresses (GitLab Issue).

When exploited, the vulnerability leads to the exposure of users' private email addresses through webhook payloads, potentially compromising user privacy and revealing sensitive contact information (GitLab Release).

The vulnerability requires an attacker to have project maintainer privileges to access the webhook payload information. The issue was discovered during an internal security review and was addressed before any known exploits in the wild (GitLab Release).

The vulnerability has been fixed in GitLab versions 15.6.1, 15.5.5, and 15.4.6. Users are strongly recommended to upgrade to these or later versions immediately. GitLab.com has already been updated with the patched version (GitLab Release).