cve.bz

CVE-2023-7028

9.8 criticalKEVEPSS 94%

Critical (9.8) in GitLab GitLab CE/EE. In CISA KEV since 2024-05-01. EPSS 94% chance of exploitation in the next 30 days.

An issue has been discovered in GitLab CE/EE affecting all versions from 16.1 prior to 16.1.6, 16.2 prior to 16.2.9, 16.3 prior to 16.3.7, 16.4 prior to 16.4.5, 16.5 prior to 16.5.6, 16.6 prior to 16.6.4, and 16.7 prior to 16.7.2 in which user account password reset emails could be delivered to an unverified email address.

Severity

CVSS 3.1

9.8 critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
94% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-31)
CISA KEV
listed 2024-05-01, due 2024-05-22
CWE
CWE-640
Published
Modified
Record from
the NVD, synced

Affected

References

Check your stackJSON