Threat Intelligence / CVE / CVE-2023-7028

CVE-2023-7028

CISA KEV

CVSS 9.8 (CRITICAL) · EPSS 93.3% · Priority 9/10 · Published 2024-01-12

As of 2025-10-24, CVE-2023-7028 is a CVSS 9.8 (CRITICAL-severity) vulnerability. CISA KEV-listed (known exploited). EPSS exploitation probability 93.3%. Threadlinqs Intelligence tracks 1 threat exploiting it.

Last updated: 2025-10-24

An issue has been discovered in GitLab CE/EE affecting all versions from 16.1 prior to 16.1.6, 16.2 prior to 16.2.9, 16.3 prior to 16.3.7, 16.4 prior to 16.4.5, 16.5 prior to 16.5.6, 16.6 prior to 16.6.4, and 16.7 prior to 16.7.2 in which user account password reset emails could be delivered to an unverified email address.

CVSS v3 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-640

Exploitation status

CISA KEV-listed (known exploited)

Threats tracking this CVE

APT35 (Charming Kitten) GCC Pre-Positioning Cyber Reconnaissance Campaign Enabling Kinetic Targeting — CRITICAL

References

Full detection coverage & IOCs for threats exploiting CVE-2023-7028 are available via the Threadlinqs MCP server (Purple tier). View plans →

← all vulnerabilities · Markdown version · Threadlinqs Intelligence

Enriched from CVE.org, NVD (this product uses the NVD API but is not endorsed or certified by the NVD), FIRST EPSS, CISA KEV, and GitHub Security Advisories.