tldrdailynews.com logo

"GitLab Issues Critical Patch for Zero-Click Account Takeover Vulnerability"

1 min read
Source: The Hacker News
"GitLab Issues Critical Patch for Zero-Click Account Takeover Vulnerability"
Photo: The Hacker News
TL;DR

GitLab has released security updates to address two critical vulnerabilities, including one that could lead to account takeover without user interaction. The flaw, tracked as CVE-2023-7028, affects self-managed instances of GitLab Community Edition and Enterprise Edition. Another critical flaw (CVE-2023-5356) was also patched, allowing a user to abuse Slack/Mattermost integrations. Users are advised to upgrade to the patched version as soon as possible and enable 2FA, especially for those with elevated privileges.

Topics:technologysoftware-security#account-takeover#devsecops#gitlab#patch#software-security#vulnerabilities
Share this article
  1. Urgent: GitLab Releases Patch for Critical Vulnerabilities - Update ASAP  The Hacker News
  2. GitLab warns of critical zero-click account hijacking vulnerability  BleepingComputer
  3. Critical GitLab flaw allows account takeover without user interaction, patch quickly! (CVE-2023-7028)  Help Net Security
  4. GitLab vulnerability risks account takeover via simple password reset  SC Media

Want the full story? Read the original reporting

Read on The Hacker News