← Back

CVE-2023-7028

nvd nistnuclei
Published: Jan 12, 2024Modified: Jun 17, 2026CISA KEV

JSON object

Loading...
9.8
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitability: 3.9 / Impact: 5.9
Source: NVD

Description

An issue has been discovered in GitLab CE/EE affecting all versions from 16.1 prior to 16.1.6, 16.2 prior to 16.2.9, 16.3 prior to 16.3.7, 16.4 prior to 16.4.5, 16.5 prior to 16.5.6, 16.6 prior to 16.6.4, and 16.7 prior to 16.7.2 in which user account password reset emails could be delivered to an unverified email address.

Affected (14)

Products: Gitlab: Gitlab
Gitlab
1 product
Gitlab
Configuration A
14 vulnerable
Vulnerable SoftwareAffected Versions
Gitlab
Gitlab
From 16.1.0 to 16.1.6
Gitlab
From 16.2.0 to 16.2.9
Gitlab
From 16.3.0 to 16.3.7
Gitlab
From 16.4.0 to 16.4.5
Gitlab
From 16.5.0 to 16.5.6
Gitlab
From 16.6.0 to 16.6.4
Gitlab
From 16.7.0 to 16.7.2
Gitlab
From 16.1.0 to 16.1.6
Gitlab
From 16.2.0 to 16.2.9
Gitlab
From 16.3.0 to 16.3.7
Gitlab
From 16.4.0 to 16.4.5
Gitlab
From 16.5.0 to 16.5.6
Gitlab
From 16.6.0 to 16.6.4
Gitlab
From 16.7.0 to 16.7.2

Related CWEs

CWE-640
Weak Password Recovery Mechanism for Forgotten Password
The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.

References (6)

Source: cve@gitlab.com
ExploitIssue TrackingVendor Advisory
Source: cve@gitlab.com
Permissions Required
Source: af854a3a-2127-422b-91ae-364da2661108
ExploitIssue TrackingVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Permissions Required
Source: af854a3a-2127-422b-91ae-364da2661108
ExploitThird Party Advisory
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0
US Government Resource

Timeline

No history available yet.