CVE-2022-3758
Description
An issue has been discovered in GitLab affecting all versions starting from 15.5 before 15.7.8, all versions starting from 15.8 before 15.8.4, all versions starting from 15.9 before 15.9.2. Due to improper permissions checks an unauthorised user was able to read, add or edit a users private snippet.
Summary dbcve.org
GitLab versions 15.5 through 15.9.1 contain improper permission checks in the snippet functionality that allow unauthorized users to read, add, or edit private snippets belonging to other users. This is an authorization bypass vulnerability stemming from missing or insufficient access control validation.
Mitigation
Upgrade GitLab to version 15.7.8, 15.8.4, or 15.9.2 or later. Alternatively, if immediate upgrade is not possible, review snippet access controls and consider restricting external user access to the instance.