Actively exploited · Published Jan 12, 2024 · Assigned by GitLab
CVE-2023-7028Weak Password Recovery Mechanism for Forgotten Password in GitLab
Critical 10.0 Exploited
In plain English
A critical-severity security flaw in GitLab from GitLab. Attackers are actively exploiting it in the wild (listed by CISA on May 1, 2024). The chance it is exploited in the next 30 days is estimated at 94.5% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, Nuclei, public proof-of-concept code. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA guidance
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Federal agencies must remediate by May 22, 2024.
Official description
An issue has been discovered in GitLab CE/EE affecting all versions from 16.1 prior to 16.1.6, 16.2 prior to 16.2.9, 16.3 prior to 16.3.7, 16.4 prior to 16.4.5, 16.5 prior to 16.5.6, 16.6 prior to 16.6.4, and 16.7 prior to 16.7.2 in which user account password reset emails could be delivered to an unverified email address.
Affected products (as reported)
Weakness: CWE-640 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
References
- GitLab Issue #436084 issue-tracking
- HackerOne Bug Bounty Report #2293343 technical-description, exploit
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-7028 government-resource
- https://www.vicarius.io/vsociety/posts/critical-gitlab-account-takeover-vulnerability-cve-2023-7028