Summary
GitLab Community and Enterprise Editions contain an improper access control vulnerability. This allows an attacker to trigger password reset emails to be sent to an unverified email address to ultimately facilitate an account takeover.
- Vendor
- GitLab
- Product
- GitLab CE/EE
- Added to KEV
- May 1, 2024
- Remediation due
- May 22, 2024 (US federal deadline)
- Ransomware use
- Not known
- Weakness
- CWE-284
- EPSS
- 94.5% as of Nov 12
In the news
- No Asia-Pacific article names this CVE yet.
Linked
Actors named alongside it:
none
Incidents exploiting it:
- none recorded
References