NetSight
IP …
critical10.0Known exploitedPublic exploit code

CVE-2023-7028

GitLab Community and Enterprise Editions Improper Access Control Vulnerability

Exploited in the wild

This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2024-05-01. Federal due date: 2024-05-22.

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

An issue has been discovered in GitLab CE/EE affecting all versions from 16.1 prior to 16.1.6, 16.2 prior to 16.2.9, 16.3 prior to 16.3.7, 16.4 prior to 16.4.5, 16.5 prior to 16.5.6, 16.6 prior to 16.6.4, and 16.7 prior to 16.7.2 in which user account password reset emails could be delivered to an unverified email address.

Affected products

VendorProductAffected versions
GitlabGitlab
from 16.1.0 before 16.1.6
from 16.2.0 before 16.2.9
from 16.3.0 before 16.3.7
from 16.4.0 before 16.4.5
from 16.5.0 before 16.5.6
from 16.6.0 before 16.6.4

Weakness classification

CWE-640

References