ACTIEF MISBRUIKT
CVE-2023-7028: GitLab Community and Enterprise Editions Improper Access Control Vulnerability
| Leverancier | GitLab |
|---|---|
| Product | GitLab CE/EE |
| Actief misbruikt | Ja |
| Toegevoegd aan CISA KEV | 1 mei 2024 |
| CISA-deadline (Amerikaanse overheid) | 22 mei 2024 |
| Zwakte (CWE) | CWE-284 |
Vereiste actie (tekst van CISA, Engels)
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Beschrijving (NVD, Engels)
GitLab Community and Enterprise Editions contain an improper access control vulnerability. This allows an attacker to trigger password reset emails to be sent to an unverified email address to ultimately facilitate an account takeover.
BRONNEN
Andere lekken bij GitLab
- CVE-2026-97229: GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability
- CVE-2026-85706: GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability
- CVE-2021-22175: GitLab Server-Side Request Forgery (SSRF) Vulnerability
- CVE-2021-39935: GitLab Community and Enterprise Editions Server-Side Request Forgery (SSRF) Vulnerability
- CVE-2021-22205: GitLab Community and Enterprise Editions Remote Code Execution Vulnerability
Gegevens van NVD, CISA KEV, FIRST EPSS en adviezen van leveranciers. Bijgewerkt 10 nov 2026.