Описание
An issue has been discovered in GitLab CE/EE affecting all versions from 16.1 prior to 16.1.6, 16.2 prior to 16.2.9, 16.3 prior to 16.3.7, 16.4 prior to 16.4.5, 16.5 prior to 16.5.6, 16.6 prior to 16.6.4, and 16.7 prior to 16.7.2 in which user account password reset emails could be delivered to an unverified email address.
Ссылки
- ExploitIssue TrackingVendor Advisory
- Permissions Required
- ExploitIssue TrackingVendor Advisory
- Permissions Required
- ExploitThird Party Advisory
- US Government Resource
Уязвимые конфигурации
Одно из
EPSS
10 Critical
CVSS3
9.8 Critical
CVSS3
Дефекты
Связанные уязвимости
An issue has been discovered in GitLab CE/EE affecting all versions from 16.1 prior to 16.1.6, 16.2 prior to 16.2.9, 16.3 prior to 16.3.7, 16.4 prior to 16.4.5, 16.5 prior to 16.5.6, 16.6 prior to 16.6.4, and 16.7 prior to 16.7.2 in which user account password reset emails could be delivered to an unverified email address.
An issue has been discovered in GitLab CE/EE affecting all versions fr ...
An issue has been discovered in GitLab CE/EE affecting all versions from 16.1 prior to 16.1.6, 16.2 prior to 16.2.9, 16.3 prior to 16.3.7, 16.4 prior to 16.4.5, 16.5 prior to 16.5.6, 16.6 prior to 16.6.4, and 16.7 prior to 16.7.2 in which user account password reset emails could be delivered to an unverified email address.
Уязвимость программной платформы на базе git для совместной работы над кодом GitLab, вызванная возможностью отправки письма с кодом для сброса пароля на неподтверждённые email-адреса, позволяющая нарушителю получить несанкционированный доступ к учётной записи произвольного пользователя
EPSS
10 Critical
CVSS3
9.8 Critical
CVSS3