CVE-2019-14944

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2019-14944
An issue was discovered in GitLab Community and Enterprise Edition before 11.11.8, 12 before 12.0.6, and 12.1 before 12.1.6. Gitaly allows injection of command-line flags. This sometimes leads to privilege escalation or remote code execution.

6.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References
Link Resource
https://about.gitlab.com/blog/categories/releases/ Release Notes
https://about.gitlab.com/releases/2019/08/12/critical-security-release-gitlab-12-dot-1-dot-6-released/ Vendor Advisory
https://gitlab.com/gitlab-org/gitaly/issues/1801 Exploit Issue Tracking Vendor Advisory
https://gitlab.com/gitlab-org/gitaly/issues/1802 Broken Link
https://about.gitlab.com/blog/categories/releases/ Release Notes
https://about.gitlab.com/releases/2019/08/12/critical-security-release-gitlab-12-dot-1-dot-6-released/ Vendor Advisory
https://gitlab.com/gitlab-org/gitaly/issues/1801 Exploit Issue Tracking Vendor Advisory
https://gitlab.com/gitlab-org/gitaly/issues/1802 Broken Link
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*
cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*
cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*
cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*
cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*
cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*
History

21 Nov 2024, 04:27

Type Values Removed Values Added
References () https://about.gitlab.com/blog/categories/releases/ - Release Notes () https://about.gitlab.com/blog/categories/releases/ - Release Notes
References () https://about.gitlab.com/releases/2019/08/12/critical-security-release-gitlab-12-dot-1-dot-6-released/ - Vendor Advisory () https://about.gitlab.com/releases/2019/08/12/critical-security-release-gitlab-12-dot-1-dot-6-released/ - Vendor Advisory
References () https://gitlab.com/gitlab-org/gitaly/issues/1801 - Exploit, Issue Tracking, Vendor Advisory () https://gitlab.com/gitlab-org/gitaly/issues/1801 - Exploit, Issue Tracking, Vendor Advisory
References () https://gitlab.com/gitlab-org/gitaly/issues/1802 - Broken Link () https://gitlab.com/gitlab-org/gitaly/issues/1802 - Broken Link

25 Apr 2023, 19:37

Type Values Removed Values Added
CPE cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*
cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 6.5
CWE CWE-77
References (MISC) https://gitlab.com/gitlab-org/gitaly/issues/1801 - (MISC) https://gitlab.com/gitlab-org/gitaly/issues/1801 - Exploit, Issue Tracking, Vendor Advisory
References (MISC) https://about.gitlab.com/blog/categories/releases/ - (MISC) https://about.gitlab.com/blog/categories/releases/ - Release Notes
References (CONFIRM) https://about.gitlab.com/releases/2019/08/12/critical-security-release-gitlab-12-dot-1-dot-6-released/ - (CONFIRM) https://about.gitlab.com/releases/2019/08/12/critical-security-release-gitlab-12-dot-1-dot-6-released/ - Vendor Advisory
References (MISC) https://gitlab.com/gitlab-org/gitaly/issues/1802 - (MISC) https://gitlab.com/gitlab-org/gitaly/issues/1802 - Broken Link

17 Apr 2023, 13:12

Type Values Removed Values Added
New CVE
Information

Published : 2023-04-16 00:15

Updated : 2025-02-06 17:15

NVD link : CVE-2019-14944

Mitre link : CVE-2019-14944

CVE.ORG link : CVE-2019-14944

JSON object : View

Products Affected

gitlab

  • gitlab
CWE
CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')