Is CVE-2023-7028 actively exploited?

Yes. CVE-2023-7028 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, which means exploitation in the wild has been confirmed.

Can CVE-2023-7028 be exploited remotely?

The attack vector of CVE-2023-7028 has not been classified yet.

What is the CVSS score of CVE-2023-7028?

CVE-2023-7028 has not received a CVSS score yet.

HOME VULNERABILITIESCVE-2023-7028

HIGHCISA KEVIN THE WILD

CVE-2023-7028

Published: May 1, 2024

EPSS:93.38%probability of exploitation in 30 daysPercentile:99.8th

Official Description

GitLab Community and Enterprise Editions contain an improper access control vulnerability. This allows an attacker to trigger password reset emails to be sent to an unverified email address to ultimately facilitate an account takeover.

NVD Source

CISA KEV Advisory

GitLab Community and Enterprise Editions Improper Access Control Vulnerability

Added to KEV: 2024-05-01Federal patch deadline: 2024-05-22

Required Action (CISA)

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Risk Analysis

An improper access control vulnerability in GitLab Community and Enterprise Editions allows attackers to trigger password reset emails to unverified addresses, leading to account takeover. This high-severity flaw, with an EPSS score of 0.93380 and inclusion in CISA's KEV, presents a significant risk to user accounts.

This vulnerability is actively being exploited in the wild. The remote nature of the attack, targeting password reset functionality, makes it a potent tool for account compromise.

Recommended Action

GitLab administrators must update to the patched versions of GitLab Community and Enterprise Editions. Implement multi-factor authentication and review email verification processes for password resets.

Generated by the CTIWATCH analysis pipeline from this CVE's metadata (CVSS, EPSS, KEV status, exploit intelligence). Verify against vendor advisories before acting.

Technical Analysis

CVE-2023-7028 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation requires some privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

CISA has added CVE-2023-7028 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. U.S. federal agencies are required to patch this within the mandated timeframe, and all organizations should treat remediation as urgent.