CVE-2023-7028
CVSS 3.1 Score 7.5 of 10 (high)
Details
Summary
CVE-2023-7028 is a vulnerability affecting GitLab CE/EE versions 16.1 to 16.7. This issue enables an attacker to manipulate password reset emails and deliver them to unintended email addresses, posing a serious risk to user accounts. Specifically, the vulnerability exists in the email delivery system, allowing an unauthorized user to intercept and redirect password reset emails to a different email address. This problem impacts all versions prior to 16.1.6, 16.2.9, 16.3.7, 16.4.5, 16.5.6, 16.6.4, and 16.7.2. Users are strongly advised to update their GitLab installations to mitigate this risk.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Affected Products
- GitLab
Affected Vendors
- GitLab Inc.
Advisories, Assessments, and Mitigations
Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future
- Gain complete coverage of your cyber, third party, and physical attack surface
- Proactively mitigate threats before they turn into costly attacks
- Make fast, effective, data-driven decisions