Maximum-severity GitLab flaw allowing account hijacking under active exploitation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2023-7028 | Unauthenticated Account Takeover via Password Reset Flaw in GitLab CE/EE | 9.8 | 94% | KEVPoC ×2 | KEV |
From the original article
1 min read at arstechnica.com
A maximum severity vulnerability that allows hackers to hijack GitLab accounts with no user interaction required is now under active exploitation, federal government officials warned as data showed that thousands of users had yet to install a patch released in January. A change GitLab implemented in May 2023 made it possible for users to initiate password changes through links sent to secondary email addresses.
arstechnica.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.