PT-2023-11342 · Gitlab · Gitlab Ce/Ee+2

Vakzz · Publicado 2023-04-15 · Atualizado 2023-04-25 · CVE-2019-14944

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions GitLab Community and Enterprise Edition versions 11.11.8 and earlier GitLab Community and Enterprise Edition versions 12.0.6 and earlier GitLab Community and Enterprise Edition versions 12.1.6 and earlier

Description An issue was discovered in GitLab Community and Enterprise Edition. Gitaly allows injection of command-line flags, which sometimes leads to privilege escalation or remote code execution.

Recommendations For versions 11.11.8 and earlier, update to version 11.11.8 or later. For versions 12.0.6 and earlier, update to version 12.0.6 or later. For versions 12.1.6 and earlier, update to version 12.1.6 or later.

Exploit

Correção

RCE

Command Injection

Enumeração de Fraquezas

CWE-77

Identificadores relacionados

CVE-2019-14944

Produtos afetados

Gitlab

Gitlab Ce/Ee

Gitaly

Referências · 9

• 🔥 https://gitlab.com/gitlab-org/gitaly/issues/1801 · Exploit
• https://t.me/cibsecurity/62250 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2019-14944 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14944 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-14944 · Nota de Segurança
• https://about.gitlab.com/blog/categories/releases · Nota
• https://t.me/cvenotify/48354 · Publicação no Telegram
• https://gitlab.com/gitlab-org/gitaly/issues/1802 · Nota
• https://about.gitlab.com/releases/2019/08/12/critical-security-release-gitlab-12-dot-1-dot-6-released · Aviso do Fabricante