VULNERABILITY INTELLIGENCE

CVE-2023-7028

CVSS score10 CRITICAL

EPSS probability94.46%

CISA KEVKnown exploited vulnerability

Published2024-01-12

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

Known Exploited Vulnerability

GitLab Community and Enterprise Editions Improper Access Control Vulnerability

Vendor / product: GitLab / GitLab CE/EE

Description

An issue has been discovered in GitLab CE/EE affecting all versions from 16.1 prior to 16.1.6, 16.2 prior to 16.2.9, 16.3 prior to 16.3.7, 16.4 prior to 16.4.5, 16.5 prior to 16.5.6, 16.6 prior to 16.6.4, and 16.7 prior to 16.7.2 in which user account password reset emails could be delivered to an unverified email address.

Weakness classification

cve@gitlab.com: CWE-640
nvd@nist.gov: CWE-640

Primary references

cve@gitlab.com — Exploit, Issue Tracking, Vendor Advisory
cve@gitlab.com — Permissions Required
af854a3a-2127-422b-91ae-364da2661108 — Exploit, Issue Tracking, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Permissions Required
af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory
134c704f-9b21-4f2e-91b3-4a467353bcc0 — US Government Resource