GitLab Community and Enterprise Editions Improper Access Control Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 01/05/2024. Patch affected systems as an emergency.
| Package | Affected versions | Patched versions |
|---|---|---|
| gitlab | ≥ 16.1.0, < 16.1.6≥ 16.2.0, < 16.2.9≥ 16.3.0, < 16.3.7≥ 16.4.0, < 16.4.5≥ 16.5.0, < 16.5.6≥ 16.6.0, < 16.6.4≥ 16.7.0, < 16.7.2 | 16.1.616.2.916.3.716.4.516.5.616.6.416.7.2 |
An issue has been discovered in GitLab CE/EE affecting all versions from 16.1 prior to 16.1.6, 16.2 prior to 16.2.9, 16.3 prior to 16.3.7, 16.4 prior to 16.4.5, 16.5 prior to 16.5.6, 16.6 prior to 16.6.4, and 16.7 prior to 16.7.2 in which user account password reset emails could be delivered to an unverified email address.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free