MEDIUM

CVE-2019-14944

Gitlab GitLab 2023-04-16 CVSS v3.1

CVSS

6.5

Description

An issue was discovered in GitLab Community and Enterprise Edition before 11.11.8, 12 before 12.0.6, and 12.1 before 12.1.6. Gitaly allows injection of command-line flags. This sometimes leads to privilege escalation or remote code execution.

Weakness (CWE)

CWE-77 Command Injection

EPSS Score

1.57%

Probability of exploitation in next 30 days

74.2th percentile

References

https://about.gitlab.com/blog/categories/releases/ Release Notes https://about.gitlab.com/releases/2019/08/12/critical-security-release-gitlab-12-dot-1-dot-6-released/ Vendor Advisory https://gitlab.com/gitlab-org/gitaly/issues/1801 Exploit, Issue Tracking, Vendor Advisory https://gitlab.com/gitlab-org/gitaly/issues/1802 Broken Link

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE