Connect with us

Hi, what are you looking for?



Thousands of GitLab Instances Unpatched Against Critical Password Reset Bug

Over 5,000 GitLab servers have yet to be patched against CVE-2023-7028, a critical password reset vulnerability.

More than 5,000 GitLab servers remain unpatched against a critical vulnerability allowing attackers to hijack the password reset process.

Tracked as CVE-2023-7028 (CVSS score of 10), the issue allows attackers to have password reset messages sent to unverified email addresses under their control, potentially leading to account takeover.

The flaw was introduced in GitLab 16.1.0, when a new option was added to allow users to have password reset messages sent to a secondary email address and allowed for these messages to be sent to unverified addresses.

Two weeks ago, GitLab released patches for the bug, warning that all accounts that allow logins with usernames and passwords and are not protected with second-factor authentication are affected.

Patches for the bug were included in GitLab Community Edition (CE) and Enterprise Edition (EE) versions 16.5.6, 16.6.4, and 16.7.2, and were also backported to versions 16.1.6, 16.2.9, 16.3.7, and 16.4.5.

Although GitLab warned of the bug’s critical severity and urged users to update their instances as soon as possible, more than 5,000 servers remain unpatched against CVE-2023-7028, non-profit cybersecurity organization The Shadowserver Foundation warned on Wednesday.

“Running GitLab? We are sharing instances vulnerable to CVE-2023-7028 (Account Takeover via Password Reset without user interactions) – 5379 instances found worldwide (on 2024-01-23). Top: US (964) & Germany (730),” the organization said on X.

The data from Shadowserver shows that hundreds of other vulnerable GitLab servers are in Russia, China, France, and the UK as well.

Advertisement. Scroll to continue reading.

Earlier this month, GitLab said that it had not observed the flaw being abused on platforms managed by GitLab, cautioning self-managed customers to review their logs for signs of exploitation and rotate all credentials if intrusions are detected.

“We strongly recommend that all installations running a version affected by the issues described are upgraded to the latest version as soon as possible,” GitLab’s advisory reads.

Related: GitLab Patches Critical Pipeline Execution Vulnerability

Related: GitLab Security Update Patches Critical Vulnerability

Related: GitLab Patches Critical Remote Code Execution Vulnerability

Written By

Ionut Arghire is an international correspondent for SecurityWeek.


Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Gain valuable insights from industry professionals who will help guide you through the intricacies of industrial cybersecurity.


Join us for an in depth exploration of the critical nature of software and vendor supply chain security issues with a focus on understanding how attacks against identity infrastructure come with major cascading effects.


Expert Insights

Related Content


Less than a week after announcing that it would suspended service indefinitely due to a conflict with an (at the time) unnamed security researcher...

Data Breaches

OpenAI has confirmed a ChatGPT data breach on the same day a security firm reported seeing the use of a component affected by an...

IoT Security

A group of seven security researchers have discovered numerous vulnerabilities in vehicles from 16 car makers, including bugs that allowed them to control car...


A researcher at IOActive discovered that home security systems from SimpliSafe are plagued by a vulnerability that allows tech savvy burglars to remotely disable...

Risk Management

The supply chain threat is directly linked to attack surface management, but the supply chain must be known and understood before it can be...


Patch Tuesday: Microsoft calls attention to a series of zero-day remote code execution attacks hitting its Office productivity suite.


Patch Tuesday: Microsoft warns vulnerability (CVE-2023-23397) could lead to exploitation before an email is viewed in the Preview Pane.


The latest Chrome update brings patches for eight vulnerabilities, including seven reported by external researchers.