Improper access control in Gitlab Community Edition and GitLab Enterprise Edition - CVE-2023-7028
Published: January 12, 2024 / Updated: February 25, 2025
Vulnerability identifier: #VU85319
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-7028
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
The vulnerability is being exploited in the wild
Vulnerability details
The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.
The vulnerability exists due to improper access restrictions. A remote attacker can deliver user account password reset emails to an unverified email address.
Affected software
Gitlab Community Edition
GitLab Enterprise Edition
GitLab Enterprise Edition
How to mitigate CVE-2023-7028
Install updates from vendor's website.
Gitlab Community Edition - addressed in versions 16.1.6, 16.2.9, 16.3.7, 16.4.5, 16.5.6, 16.6.4, 16.7.2
GitLab Enterprise Edition - addressed in versions 16.1.6, 16.2.9, 16.3.7, 16.4.5, 16.5.6, 16.6.4, 16.7.2
GitLab Enterprise Edition - addressed in versions 16.1.6, 16.2.9, 16.3.7, 16.4.5, 16.5.6, 16.6.4, 16.7.2
Links to Public Exploits and PoC-codes
- Exploit #11172 - CVE-2023-7028 () (February 25, 2025)
- Exploit #11028 - CVE-2023-7028 (CVE-2023-7028 POC && Exploit) (December 27, 2024)
- Exploit #10751 - GitLab CE/EE < 16.7.2 - Password Reset (October 25, 2024)
- Exploit #10584 - CVE-2023-7028 (CVE-2023-7028 POC && Exploit) (October 11, 2024)
- Exploit #10258 - CVE-2023-7028 (Implementation and exploitation of CVE-2023-7028 account takeover vulnerability related to GO-TO CVE weekly articles of the 11th week.) (July 26, 2024)
- Exploit #10166 - Exploit_CVE_2023_7028- (Exploit_CVE_2023_7028 ) (July 5, 2024)
- Exploit #9815 - CVE-2023-7028 (CVE-2023-7028 poc) (May 13, 2024)
- Exploit #9670 - CVE-2023-7028 (This repository presents a proof-of-concept of CVE-2023-7028) (April 5, 2024)
- Exploit #9599 - GitLab Password Reset Account Takeover (March 7, 2024)
- Exploit #9525 - CVE-2023-7028 (Python Code for Exploit Automation CVE-2023-7028) (January 26, 2024)