by Kastro
Paper/Archive/CVE-2023-7028

CVE-2023-7028

GitLab GitLab — Weak Password Recovery Mechanism for Forgotten Password in GitLab

KEV · due 22 MayEPSS 94%public exploitSSVC actCVSS 10.0
critical.is priorityof 100
100
CVSS 10.0 (CNA)10.0 / 10 × 3030.0In CISA KEV+3030.0EPSS percentile 99.9.999 × 2020.0Exploit: SSVC active+1010.0SSVC exploitation: active+1010.0
Description · from the CVE record

An issue has been discovered in GitLab CE/EE affecting all versions from 16.1 prior to 16.1.6, 16.2 prior to 16.2.9, 16.3 prior to 16.3.7, 16.4 prior to 16.4.5, 16.5 prior to 16.5.6, 16.6 prior to 16.6.4, and 16.7 prior to 16.7.2 in which user account password reset emails could be delivered to an unverified email address.

Affected

ProductAffectedFixed inSource
GitLab16.1 – < 16.1.616.1.6CNA
GitLab16.2 – < 16.2.916.2.9CNA
GitLab16.3 – < 16.3.716.3.7CNA
GitLab16.4 – < 16.4.516.4.5CNA
GitLab16.5 – < 16.5.616.5.6CNA
GitLab16.6 – < 16.6.416.6.4CNA
GitLab16.7 – < 16.7.216.7.2CNA

Scores by source

GitLab (CNA)10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
CISA ADPSSVCExploitation: active · Automatable: yes · Technical impact: total

References

refgitlab.com/gitlab-org/gitlab/-/issues/436084exploithackerone.com/reports/2293343refcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-7028refvicarius.io/vsociety/posts/critical-gitlab-account-takeover-vulnerability-cve-2023-7028kevcisa.gov/known-exploited-vulnerabilities-catalog