H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Vulnerability

CVE-2023-7028

GitLab Community and Enterprise Editions contain an improper access control vulnerability. This allows an attacker to trigger password reset emails to be sent to an unverified email address to ultimately facilitate an account takeover.

Vulnerability
TypeVulnerability
External ID—
First seen2024-05-01
Last seen2024-05-01

Confidence

—

GitLab Community and Enterprise Editions contain an improper access control vulnerability. This allows an attacker to trigger password reset emails to be sent to an unverified email address to ultimately facilitate an account takeover.

Labels

exploitedkev

CISA KEV context

Vendor / productGitLab GitLab CE/EE
Added2024-05-01
Due date2024-05-22
18 recorded

Relationships

mitigates
from Remediate CVE-2023-7028
Mitigation
related-to
to Add Malicious File to Shared Webroot
Technique
related-to
to Data Injected During Configuration
Technique
related-to
to Disable Security Software
Technique
related-to
to Embedding Scripts within Scripts
Technique
related-to
to Incomplete Data Deletion in a Multi-Tenant Environment
Technique
related-to
to Install New Service
Technique
related-to
to Install Rootkit
Technique
related-to
to Intent Spoof
Technique
related-to
to Malicious Logic Insertion
Technique
related-to
to Malicious Root Certificate
Technique
related-to
to Modification of Windows Service Configuration
Technique
related-to
to Modify Existing Service
Technique
related-to
to Modify Shared File
Technique
related-to
to Replace File Extension Handlers
Technique
related-to
to Replace Trusted Executable
Technique
related-to
to Run Software at Logon
Technique
related-to
to WebView Exposure
Technique
2 external

References

nvd
CVE-2023-7028
open
cwe
CWE-284
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance