CVE-2023-7028criticalunder attackCWE-640

CVE-2023-7028: critical vulnerability in GitLab

Weak Password Recovery Mechanism for Forgotten Password in GitLab

Published · Updated

Follow this CVE+ Monitor GitLab+ Monitor GitLab CE/EE

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 10epss 94%
from disclosure to weaponsame day
Published on NVDJan 12
1st PoCJan 12
metasploitJan 11
CISA KEV+110d
Action required by CISAfederal deadline: 2024-05-22

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

In short

GitLab's password reset feature could send recovery emails to unverified email addresses, allowing attackers to take over accounts by changing passwords without proper verification.

Technical detail

A flaw in GitLab's password recovery mechanism (CWE-640) permits password reset tokens to be delivered to unverified email addresses without prior ownership validation. An attacker can register an account with a victim's email, receive the password reset link, and gain unauthorized access to the target account. This affects multiple GitLab versions across CE/EE deployments.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

An issue has been discovered in GitLab CE/EE affecting all versions from 16.1 prior to 16.1.6, 16.2 prior to 16.2.9, 16.3 prior to 16.3.7, 16.4 prior to 16.4.5, 16.5 prior to 16.5.6, 16.6 prior to 16.6.4, and 16.7 prior to 16.7.2 in which user account password reset emails could be delivered to an unverified email address.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
Affected products
GitLab · GitLab
public PoCs found — 36
exploitdbwww.exploit-db.com/exploits/51889unverifiedgithubgithub.com/Vozec/CVE-2023-7028★ 244githubgithub.com/RandomRobbieBF/CVE-2023-7028★ 55githubgithub.com/Esonhugh/gitlab_honeypot★ 4githubgithub.com/sariamubeen/CVE-2023-7028★ 3githubgithub.com/Trackflaw/CVE-2023-7028-Docker★ 3githubgithub.com/duy-31/CVE-2023-7028★ 3githubgithub.com/thanhlam-attt/CVE-2023-7028★ 2githubgithub.com/szybnev/CVE-2023-7028★ 2githubgithub.com/hackeremmen/gitlab-exploit★ 1githubgithub.com/gh-ost00/CVE-2023-7028★ 1githubgithub.com/Sornphut/CVE-2023-7028-GitLab★ 0githubgithub.com/yoryio/CVE-2023-7028★ 0githubgithub.com/soltanali0/CVE-2023-7028★ 0githubgithub.com/Shimon03/CVE-2023-7028-Account-Take-Over-Gitlab★ 0githubgithub.com/googlei1996/CVE-2023-7028★ 0githubgithub.com/mochammadrafi/CVE-2023-7028★ 0githubgithub.com/KameliaZaman/Exploiting-GitLab-CVE-2023-7028★ 0githubgithub.com/FearThePLOTO/GitLab-CVE-2023-7028★ 0vulncheckvulncheck.com/xdb/0f7be935ff85unverifiedvulncheckvulncheck.com/xdb/da63a9b40012unverifiedvulncheckvulncheck.com/xdb/87e14763757cunverifiedvulncheckvulncheck.com/xdb/516e0f5addf3unverifiedvulncheckvulncheck.com/xdb/3a9685d9145cunverifiedvulncheckvulncheck.com/xdb/d0511db0dc7aunverifiedvulncheckvulncheck.com/xdb/3703b3de223cunverifiedvulncheckvulncheck.com/xdb/522b3884b9b8unverifiedvulncheckvulncheck.com/xdb/44c05ef0c116unverifiedvulncheckvulncheck.com/xdb/29c90b604ec4unverifiedvulncheckvulncheck.com/xdb/674d0aabf7ceunverifiedvulncheckvulncheck.com/xdb/d5208cb503c5unverifiedcve_referencehackerone.com/reports/2293343unverifiedvulncheckvulncheck.com/xdb/90b5573c67baunverifiedvulncheckvulncheck.com/xdb/acdabc43c05funverifiedvulncheckvulncheck.com/xdb/877497541569unverifiedvulncheckvulncheck.com/xdb/e0d36e3116c6unverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — GitLab

In the same product, most dangerous first.

CVE-2021-22205CRITICALCVE-2021-22205EPSS 99.7%KEVCVE-2026-85706CRITICALImproper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLabEPSS 97.4%KEVCVE-2026-97229CRITICALInteger Overflow or Wraparound in GitLabEPSS 65.2%KEVCVE-2021-22175MEDIUMCVE-2021-22175EPSS 53.4%KEVCVE-2021-39935MEDIUMCVE-2021-39935EPSS 36.1%KEVCVE-2023-2442HIGHCVE-2023-2442EPSS 96.1%