# GitLab中用于 forgotten password 的弱密码恢复机制
## 概述
GitLab CE/EE 版本中存在一个漏洞，该漏洞可能导致用户账户密码重置邮件被发送到未验证的邮箱地址。
## 影响版本
- 16.1 系列：16.1.0 至 16.1.5
- 16.2 系列：16.2.0 至 16.2.8
- 16.3 系列：16.3.0 至 16.3.6
- 16.4 系列：16.4.0 至 16.4.4
- 16.5 系列：16.5.0 至 16.5.5
- 16.6 系列：16.6.0 至 16.6.3
- 16.7 系列：16.7.0 至 16.7.1
## 细节
此漏洞导致用户账户的密码重置邮件可能被发送到未经过验证的邮箱地址。这可能导致密码重置过程中的安全问题，使得未经授权的用户能够接收重置邮件，从而访问用户的账户。
## 影响
该漏洞可能导致未授权用户获取密码重置邮件，进而潜在地危害用户账户的安全。
| # | POC 描述 | 源链接 | 神龙链接 |
|---|---|---|---|
| 1 | CVE-2023-7028 poc | https://github.com/V1lu0/CVE-2023-7028 | POC详情 |
| 2 | CVE-2023-7028 | https://github.com/RandomRobbieBF/CVE-2023-7028 | POC详情 |
| 3 | An issue has been discovered in GitLab CE/EE affecting all versions from 16.1 prior to 16.1.6, 16.2 prior to 16.2.9, 16.3 prior to 16.3.7, 16.4 prior to 16.4.5, 16.5 prior to 16.5.6, 16.6 prior to 16.6.4, and 16.7 prior to 16.7.2 in which user account password reset emails could be delivered to an unverified email address. | https://github.com/duy-31/CVE-2023-7028 | POC详情 |
| 4 | This repository presents a proof-of-concept of CVE-2023-7028 | https://github.com/Vozec/CVE-2023-7028 | POC详情 |
| 5 | Exploit for CVE-2023-7028 | https://github.com/yoryio/CVE-2023-7028 | POC详情 |
| 6 | CVE-2023-7028 killer | https://github.com/Esonhugh/gitlab_honeypot | POC详情 |
| 7 | Exploit of account take-over in Gitlab | https://github.com/TheRedDevil1/CVE-2023-7028 | POC详情 |
| 8 | None | https://github.com/Shimon03/CVE-2023-7028-Account-Take-Over-Gitlab | POC详情 |
| 9 | None | https://github.com/thanhlam-attt/CVE-2023-7028 | POC详情 |
| 10 | Repository to install CVE-2023-7028 vulnerable Gitlab instance | https://github.com/Trackflaw/CVE-2023-7028-Docker | POC详情 |
| 11 | Python Code for Exploit Automation CVE-2023-7028 | https://github.com/mochammadrafi/CVE-2023-7028 | POC详情 |
| 12 | GitLab CVE-2023-7028 | https://github.com/hackeremmen/gitlab-exploit | POC详情 |
| 13 | Implementation and exploitation of CVE-2023-7028 account takeover vulnerability related to GO-TO CVE weekly articles of the 11th week. | https://github.com/soltanali0/CVE-2023-7028 | POC详情 |
| 14 | CVE-2023-7028 poc | https://github.com/googlei1996/CVE-2023-7028 | POC详情 |
| 15 | CVE-2023-7028 POC && Exploit | https://github.com/fa-rrel/CVE-2023-7028 | POC详情 |
| 16 | CVE-2023-7028 POC && Exploit | https://github.com/gh-ost00/CVE-2023-7028 | POC详情 |
| 17 | None | https://github.com/sariamubeen/CVE-2023-7028 | POC详情 |
| 18 | None | https://github.com/Sornphut/CVE-2023-7028-GitLab | POC详情 |
| 19 | An issue has been discovered in GitLab CE/EE affecting all versions from 16.1 prior to 16.1.6, 16.2 prior to 16.2.9, 16.3 prior to 16.3.7, 16.4 prior to 16.4.5, 16.5 prior to 16.5.6, 16.6 prior to 16.6.4, and 16.7 prior to 16.7.2 in which user account password reset emails could be delivered to an unverified email address. | https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-7028.yaml | POC详情 |