VulnerabilitycriticalExploited in the wild

Critical GitLab flaw allows account takeover without user interaction, patch quickly! (CVE-2023-7028)

Help Net Securityby @zeljkazorzMay 2, 2024 · 08:55 UTC (May 2, 2024)2 min read4 · 1 read

Read at helpnetsecurity.com

Analyze CVE-2023-7028 with Vani AIImpact, affected versions, exploitation, mitigations and detection

CVEs: CVE-2023-7028 CVE-2023-5356 CVE-2023-4812 CVE-2023-6955 CVE-2023-2030

Tags: cve-2023-7028 cve-2023-5356 cve-2023-4812 cve-2023-6955 cve-2023-2030 vulnerability

Vulnerabilities mentioned

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2023-5356 +3 related CVEs CVE-2023-6955 CVE-2023-4812 CVE-2023-2030	Incorrect authorization checks in GitLab CE/EE from all versions starting from 8.13 before 16.5.6, all versions starting from 16.6 before 16.6.4, all versions…	8.8 group max	<1%		Jan 12, 2024
CVE-2023-7028	Unauthenticated Account Takeover via Password Reset Flaw in GitLab CE/EE	9.8	94%	KEVPoC ×2	Jan 12, 2024 KEV May 1, 2024

From the original article

2 min read at helpnetsecurity.com

A critical vulnerability in GitLab CE/EE (CVE-2023-7028) can be easily exploited by attackers to reset GitLab user account passwords. While also vulnerable, users who have two-factor authentication enabled on their account are safe from account takeover. “We have not detected any abuse of this vulnerability on platforms managed by GitLab, including GitLab.

Help Net Security

By @zeljkazorz · helpnetsecurity.com

Read the full article at Help Net Security

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.