The vulnerability of the Git-based software platform for collaborative code development on GitLab arises from the possibility of sending a code-based email with a password reset to unverified email addresses. This allows attackers to gain unauthorized access to any user’s account.

A vulnerability allows remote attackers to reset any user password by sending code in password reset emails to unverified addresses on GitLab.

Reporter	Title	Published	Views	Family All 49
GithubExploit	Exploit for Weak Password Recovery Mechanism for Forgotten Password in Gitlab	21 Jul 202512:34	–	githubexploit
GithubExploit	Exploit for Weak Password Recovery Mechanism for Forgotten Password in Gitlab	21 Aug 202404:14	–	githubexploit
GithubExploit	Exploit for Weak Password Recovery Mechanism for Forgotten Password in Gitlab	12 Jan 202410:53	–	githubexploit
GithubExploit	Exploit for Weak Password Recovery Mechanism for Forgotten Password in Gitlab	12 Jan 202415:17	–	githubexploit
GithubExploit	Exploit for Weak Password Recovery Mechanism for Forgotten Password in Gitlab	17 Feb 202502:15	–	githubexploit
GithubExploit	Exploit for Weak Password Recovery Mechanism for Forgotten Password in Gitlab	23 Jan 202410:37	–	githubexploit
GithubExploit	Exploit for Weak Password Recovery Mechanism for Forgotten Password in Gitlab	18 Jan 202405:17	–	githubexploit
GithubExploit	Exploit for Weak Password Recovery Mechanism for Forgotten Password in Gitlab	12 Jan 202418:29	–	githubexploit
GithubExploit	Exploit for Weak Password Recovery Mechanism for Forgotten Password in Gitlab	23 Jan 202419:11	–	githubexploit
0day.today	GitLab CE/EE < 16.7.2 - Password Reset Vulnerability	14 Mar 202400:00	–	zdt

Vulners

Node

gitlab gitlabRange16.1–16.1.6

gitlab gitlabRange16.2–16.2.9

gitlab gitlabRange16.3–16.3.7

gitlab gitlabRange16.4–16.4.5

gitlab gitlabRange16.6–16.6.4

gitlab gitlabRange16.7–16.7.2

Source	Link
opennet	www.opennet.ru/opennews/art.shtml
helpnetsecurity	www.helpnetsecurity.com/2024/01/12/cve-2023-7028/
about	www.about.gitlab.com/releases/2024/01/11/critical-security-release-gitlab-16-7-2-released/
gitlab	www.gitlab.com/gitlab-org/gitlab/-/issues/436084
cisa	www.cisa.gov/sites/default/files/csv/known_exploited_vulnerabilities.csv
web	www.web.nvd.nist.gov/view/vuln/detail

24 Sep 2024 00:00Current

7.9High risk

Vulners AI Score7.9

CVSS 210

CVSS 310

EPSS0.94955