CVE-2023-7028

🔥 Known Exploited (CISA KEV)CRITICAL

10.0

CVSS Severity Score

EPSS Score0.0000%

EPSS Percentile0.00th

Published2024-01-12

Last Modified2026-06-17

Data SourcesNVDCISA KEV

Vulnerability Description

An issue has been discovered in GitLab CE/EE affecting all versions from 16.1 prior to 16.1.6, 16.2 prior to 16.2.9, 16.3 prior to 16.3.7, 16.4 prior to 16.4.5, 16.5 prior to 16.5.6, 16.6 prior to 16.6.4, and 16.7 prior to 16.7.2 in which user account password reset emails could be delivered to an unverified email address.

Affected Platforms (CPE)

📦

Gitlab

>= 16.1.0 and < 16.1.6>= 16.2.0 and < 16.2.9>= 16.3.0 and < 16.3.7>= 16.4.0 and < 16.4.5>= 16.5.0 and < 16.5.6>= 16.6.0 and < 16.6.4>= 16.7.0 and < 16.7.2

References & Advisories

🔗 https://gitlab.com/gitlab-org/gitlab/-/issues/436084

🔗 https://hackerone.com/reports/2293343

🔗 https://gitlab.com/gitlab-org/gitlab/-/issues/436084

🔗 https://hackerone.com/reports/2293343

🔗 https://www.vicarius.io/vsociety/posts/critical-gitlab-account-takeover-vulnerability-cve-2023-7028

🔗 https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-7028

CVE-2023-7028

Vulnerability Description

Affected Platforms (CPE)

Gitlab

References & Advisories

相關資安分析文章

全球網絡威脅情報摘要：2026 年 7 月 21 日

相關漏洞威脅