CVE-2023-7028 Improper Access Control in GitLab

2024-01-1213:56:41

CWE-640

GitLab

github.com

cve-2023-7028

gitlab

access control

password reset

vulnerability

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

AI Score

8.2

Confidence

High

EPSS

0.957

Percentile

99.5%

SSVC

Exploitation

active

Automatable

yes

Technical Impact

total

JSON

An issue has been discovered in GitLab CE/EE affecting all versions from 16.1 prior to 16.1.6, 16.2 prior to 16.2.9, 16.3 prior to 16.3.7, 16.4 prior to 16.4.5, 16.5 prior to 16.5.6, 16.6 prior to 16.6.4, and 16.7 prior to 16.7.2 in which user account password reset emails could be delivered to an unverified email address.