A critical GitLab vulnerability that could enable account takeover was added to the Cybersecurity & Infrastructure Security Agency’s (CISA) Known Exploited Vulnerabilities (KEV) Catalog. The vulnerability, tracked as CVE-2023-7028, enables an attacker to craft a specially formatted HTTP request that causes a password reset email to be sent to an unverified attacker-controlled email address, a GitLab spokesperson previously told SC Media.

Source: SC Magazine