Vulnerabilitycritical

GitLab fixed a critical zero

Security Affairsby @securityaffairsJan 13, 2024 · 17:52 UTC (Jan 13, 2024)2 min read5 · 1 read

Read at securityaffairs.com

Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

CVEs: CVE-2023-7028 CVE-2023-5356 CVE-2023-4812 CVE-2023-6955 CVE-2023-2030

Tags: cve-2023-7028 cve-2023-5356 cve-2023-4812 cve-2023-6955 cve-2023-2030 vulnerability

Vulnerabilities mentioned

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2023-5356 +3 related CVEs CVE-2023-6955 CVE-2023-4812 CVE-2023-2030	Incorrect authorization checks in GitLab CE/EE from all versions starting from 8.13 before 16.5.6, all versions starting from 16.6 before 16.6.4, all versions…	8.8 group max	<1%		Jan 12, 2024
CVE-2023-7028	Unauthenticated Account Takeover via Password Reset Flaw in GitLab CE/EE	9.8	94%	KEVPoC ×2	Jan 12, 2024 KEV May 1, 2024

From the original article

2 min read at securityaffairs.com

GitLab addressed two critical flaws impacting both the Community and Enterprise Edition, including a critical zero-click account hijacking vulnerability GitLab has released security updates to address two critical vulnerabilities impacting both the Community and Enterprise Edition. The most critical vulnerability, tracked as CVE-2023-7028 (CVSS score 10), is an account takeover via Password Reset.

Security Affairs

By @securityaffairs · securityaffairs.com

Read the full article at Security Affairs

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.