CVE-2023-7028

Published Jan 12, 2024

Last updated a year ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2023-7028 is an account takeover vulnerability affecting GitLab Community Edition (CE) and Enterprise Edition (EE). It allows attackers to reset a user's password by exploiting a flaw in the password reset email process. By providing two email addresses during the reset request, the attacker can have the reset code sent to both their own email and the target's email address, thus gaining control of the account. Users with two-factor authentication enabled and those using LDAP logins are not susceptible to this vulnerability. This vulnerability has been actively exploited, prompting the Cybersecurity and Infrastructure Security Agency (CISA) to add it to its Known Exploited Vulnerabilities Catalog in May 2024. It was assigned a maximum CVSS score of 10, indicating its critical nature.

Description: An issue has been discovered in GitLab CE/EE affecting all versions from 16.1 prior to 16.1.6, 16.2 prior to 16.2.9, 16.3 prior to 16.3.7, 16.4 prior to 16.4.5, 16.5 prior to 16.5.6, 16.6 prior to 16.6.4, and 16.7 prior to 16.7.2 in which user account password reset emails could be delivered to an unverified email address.
Source: cve@gitlab.com
NVD status: Analyzed
Products: gitlab

Risk scores

CVSS 3.1

Type: Primary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

Known exploits

Data from CISA

Vulnerability name: GitLab Community and Enterprise Editions Improper Access Control Vulnerability
Exploit added on: May 1, 2024
Exploit action due: May 22, 2024
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Weaknesses

cve@gitlab.com: CWE-640
nvd@nist.gov: CWE-640

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*",
            "matchCriteriaId": "4D1D5473-F384-420D-BD91-F2466F2CA278",
            "versionEndExcluding": "16.1.6",
            "versionStartIncluding": "16.1.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*",
            "matchCriteriaId": "6BEF9E84-75C1-41C0-BE14-7F550E2BE932",
            "versionEndExcluding": "16.1.6",
            "versionStartIncluding": "16.1.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*",
            "matchCriteriaId": "1D29FF9D-9113-44A9-99C2-074B1B217B7C",
            "versionEndExcluding": "16.2.9",
            "versionStartIncluding": "16.2.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*",
            "matchCriteriaId": "AEA35F1C-5E02-407B-ADC6-4FDEFF885E59",
            "versionEndExcluding": "16.2.9",
            "versionStartIncluding": "16.2.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*",
            "matchCriteriaId": "B3F039EF-84DD-41B6-AB5D-BF3F44A488C2",
            "versionEndExcluding": "16.3.7",
            "versionStartIncluding": "16.3.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*",
            "matchCriteriaId": "02C5947D-659A-4AE9-B2C8-08287AC03BF2",
            "versionEndExcluding": "16.3.7",
            "versionStartIncluding": "16.3.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*",
            "matchCriteriaId": "C89EFE63-81D9-4964-BE91-BF31AA40C165",
            "versionEndExcluding": "16.4.5",
            "versionStartIncluding": "16.4.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*",
            "matchCriteriaId": "4B4C9455-DBA2-480B-8C59-898BC9DB8795",
            "versionEndExcluding": "16.4.5",
            "versionStartIncluding": "16.4.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*",
            "matchCriteriaId": "A1A5DDAD-5B04-4643-8ACD-15D7C6CD76C2",
            "versionEndExcluding": "16.5.6",
            "versionStartIncluding": "16.5.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*",
            "matchCriteriaId": "24A21A70-46F1-4B28-BECB-4266AABBBD57",
            "versionEndExcluding": "16.5.6",
            "versionStartIncluding": "16.5.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*",
            "matchCriteriaId": "7198B7E4-9928-4B7D-9D00-6B76CCAC3875",
            "versionEndExcluding": "16.6.4",
            "versionStartIncluding": "16.6.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*",
            "matchCriteriaId": "D294EA47-B2EF-42D6-A92B-93CEA5D209B7",
            "versionEndExcluding": "16.6.4",
            "versionStartIncluding": "16.6.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*",
            "matchCriteriaId": "E66EC8A8-E889-450A-86B4-7D930788FF58",
            "versionEndExcluding": "16.7.2",
            "versionStartIncluding": "16.7.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*",
            "matchCriteriaId": "DDBB44E5-7ED3-4C9B-9241-2E6DB79A3E27",
            "versionEndExcluding": "16.7.2",
            "versionStartIncluding": "16.7.0",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.