Lucene search
0xB4551337DAY-ID-39456HistoryMar 14, 2024 - 12:00 a.m.
GitLab CE/EE < 16.7.2 - Password Reset Vulnerability
2024-03-1400:00:00
0xB455
0day.today
166
gitlab
password reset
vulnerability
exploit
sebastian kriesten
twitter
vendor homepage
disclosure
version
cve-2023-7028
10 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
7.2 High
AI Score
Confidence
Low
0.96 High
EPSS
Percentile
99.5%
# Exploit Title: GitLab CE/EE < 16.7.2 - Password Reset
# Exploit Author: Sebastian Kriesten (0xB455)
# Twitter: https://twitter.com/0xB455
# Vendor Homepage: gitlab.com
# Vulnerability disclosure: https://about.gitlab.com/releases/2024/01/11/critical-security-release-gitlab-16-7-2-released/
# Version: <16.7.2, <16.6.4, <16.5.6
# CVE: CVE-2023-7028
Proof of Concept:
user[email][][email protected]&user[email][][email protected]
Related
thn
thn
hivepro
hivepro
GitLab Fixes Critical Account Takeover Vulnerability
2024-01-18 15:10:14
nvd
nvd
CVE-2023-7028
2024-01-12 14:15:49
osv
osv
BIT-gitlab-2023-7028
2024-03-06 10:53:45
CVE-2023-7028
2024-01-12 14:15:49
prion
prion
Design/Logic Flaw
2024-01-12 14:15:00
githubexploit
githubexploit
Exploit for Improper Access Control in Gitlab
2024-01-23 19:11:11
Exploit for Improper Access Control in Gitlab
2024-01-12 18:29:27
Exploit for Improper Access Control in Gitlab
2024-01-26 06:29:34
packetstorm
packetstorm
GitLab CE/EE Password Reset
2024-03-14 00:00:00
cve
cve
CVE-2023-7028
2024-01-12 14:15:49
debiancve
debiancve
CVE-2023-7028
2024-01-12 14:15:49
cisa_kev
cisa_kev
attackerkb
attackerkb
CVE-2023-7028
2024-01-12 00:00:00
cvelist
cvelist
CVE-2023-7028 Improper Access Control in GitLab
2024-01-12 13:56:41
nessus
nessus
ubuntucve
ubuntucve
CVE-2023-7028
2024-01-12 00:00:00
veracode
veracode
Account Take Over
2024-01-17 19:08:38
nuclei
nuclei
GitLab - Account Takeover via Password Reset
2024-01-14 07:28:32
metasploit
metasploit
GitLab Password Reset Account Takeover
2024-01-18 21:19:26
exploitdb
exploitdb
GitLab CE/EE < 16.7.2 - Password Reset
2024-03-14 00:00:00
malwarebytes
malwarebytes
GitLab warns zero-click vulnerability could lead to account takeovers
2024-01-16 11:01:16
rapid7blog
rapid7blog
Metasploit Wrap-Up 03/15/2024
2024-03-15 18:20:02
freebsd
freebsd
Gitlab -- vulnerabilities
2024-01-11 00:00:00
avleonov
avleonov
10 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
7.2 High
AI Score
Confidence
Low
0.96 High
EPSS
Percentile
99.5%
Related for 1337DAY-ID-39456