CVE-2022-4343: 
GitLab vulnerability analysis and mitigation

An issue was discovered in GitLab Enterprise Edition (EE) affecting all versions starting from 13.12 before 16.1.5, all versions starting from 16.2 before 16.2.5, and all versions starting from 16.3 before 16.3.1 where a project member could leak credentials stored in site profile (GitLab Release, NVD).

The vulnerability allows project members to leak credentials stored in DAST scanners' Site Profile, including request headers and authentication passwords. The issue has a CVSS v3.1 Base Score of 5.0 (Medium) with a vector string of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N. The vulnerability is classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) (NVD).

The vulnerability allows any project member with appropriate access to expose sensitive credentials stored in the site profile, potentially compromising the security of DAST scanner configurations and authentication mechanisms (GitLab Release).

The vulnerability has been fixed in GitLab versions 16.1.5, 16.2.5, and 16.3.1. Users are strongly recommended to upgrade to these patched versions immediately. GitLab.com has already been updated with the patched version (GitLab Release).