Weak Password Recovery Mechanism for Forgotten Password in GitLab
CVSS score
10.0
EPSS probability
%94.6
Risk score
18.9
Published
2 y ago
Public Exploits · GitHub and Metasploit Intelligence
This tab scans the sources that NVD labels as exploits, GitHub repositories matching the CVE identifier and Rapid7 Metasploit Framework modules. Only links to sources that were actually found are shown.
A mock app for the GitLab CVE-2023-7028, which allow multile email adresses when ordering a password reset.
Penetration test targeting CVE-2023-7028
This FORK of repository presents a proof-of-concept of CVE-2023-7028. I am only improve exploit usage
Implementation and exploitation of CVE-2023-7028 account takeover vulnerability related to GO-TO CVE weekly articles of the 11th week.
GitLab CE/EE < 16.7.2 - Password Reset
Nuclei: GitLab - Account Takeover via Password Reset
Similar Vulnerabilities
Vulnerability in GitLab
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab
Server-side request forgery in GitLab
Improper Control of Generation of Code ('Code Injection') in GitLab
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
Missing Authorization in GitLab
Get this vulnerability through the API
Affected products, version ranges, exploitation status and patch information in a single request, with a free key.
curl -H "x-api-key: $DAYBREACH_API_KEY" \ "https://api.daybreach.dev/api/v1/intel/cves/CVE-2023-7028"