onyx

onyx --cves cve-2023-7028

CVE-2023-7028

N/AKEVNUCLEI ↗GitLab
score
<0.1
cvss
—
epss
94.5% ▼0.2
published
—
kev added
2024-05-01
first seen

GitLab Community and Enterprise Editions contain an improper access control vulnerability. This allows an attacker to trigger password reset emails to be sent to an unverified email address to ultimately facilitate an account takeover.

Timeline

How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.

events2024-05-01 — Added to CISA KEVK2026-10-21 (seen by) — Tracked by OnyxT2026-10-21 (seen by) — Nuclei template: GitLab - Account Takeover via Password ResetNscore2026-10-21: score <0.1<0.1epss2026-09-22: epss 94.6%2026-09-23: epss 94.6%2026-09-24: epss 94.6%2026-09-25: epss 94.6%2026-09-26: epss 94.6%2026-09-27: epss 94.6%2026-09-28: epss 94.6%2026-09-29: epss 94.6%2026-09-30: epss 94.6%2026-10-01: epss 94.6%2026-10-02: epss 94.6%2026-10-03: epss 94.6%2026-10-04: epss 94.6%2026-10-05: epss 94.6%2026-10-06: epss 94.6%2026-10-07: epss 94.6%2026-10-08: epss 94.6%2026-10-09: epss 94.6%2026-10-10: epss 94.6%2026-10-11: epss 94.6%2026-10-12: epss 94.6%2026-10-13: epss 94.6%2026-10-14: epss 94.6%2026-10-15: epss 94.6%2026-10-16: epss 94.6%2026-10-18: epss 94.5%2026-10-19: epss 94.5%2026-10-20: epss 94.5%2026-10-21: epss 94.5%94.5%mentions/day0no mentions in 30 days2026-09-22today
  1. Added to CISA KEV
  2. Tracked by Onyx
  3. Nuclei template GitLab - Account Takeover via Password Reset

Nuclei template

A verified check exists — you can scan for this today, and so can everyone else.

template
GitLab - Account Takeover via Password Reset
severity
HIGH
first seen
nuclei -id CVE-2023-7028 -u https://target.example

Weaknesses

CWE-284

References 2