CVE-2019-14944

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

An issue was discovered in GitLab Community and Enterprise Edition before 11.11.8, 12 before 12.0.6, and 12.1 before 12.1.6. Gitaly allows injection of command-line flags. This sometimes leads to privilege escalation or remote code execution.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Weakness enumeration

CWE-77

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://about.gitlab.com/blog/categories/releases/Release Notes
https://about.gitlab.com/releases/2019/08/12/critical-security-release-gitlab-12-dot-1-dot-6-released/Vendor Advisory
https://gitlab.com/gitlab-org/gitaly/issues/1801Exploit, Issue Tracking, Vendor Advisory
https://gitlab.com/gitlab-org/gitaly/issues/1802Broken Link
https://about.gitlab.com/blog/categories/releases/Release Notes
https://about.gitlab.com/releases/2019/08/12/critical-security-release-gitlab-12-dot-1-dot-6-released/Vendor Advisory
https://gitlab.com/gitlab-org/gitaly/issues/1801Exploit, Issue Tracking, Vendor Advisory
https://gitlab.com/gitlab-org/gitaly/issues/1802Broken Link

Timeline

Published: Apr 16, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-149455.4The ultimate-member plugin before 2.0.54 for WordPress has XSS.CVE-2019-149465.4The ultimate-member plugin before 2.0.52 for WordPress has XSS related to UM Roles create and edit operations.CVE-2019-149475.4The ultimate-member plugin before 2.0.52 for WordPress has XSS during an account upgrade.CVE-2019-149485.4The woocommerce-product-addon plugin before 18.4 for WordPress has XSS via an import of a new meta data structure.CVE-2019-149496.1The wp-database-backup plugin before 5.1.2 for WordPress has XSS.CVE-2019-149506.1The wp-live-chat-support plugin before 8.0.27 for WordPress has XSS via the GDPR page.CVE-2019-149517.5The Telenav Scout GPS Link app 1.x for iOS, as used with Toyota and Lexus vehicles, has an incorrect protection mechanism against brute-forc CVE-2019-149526.1JetBrains YouTrack versions before 2019.1.52584 had a possible XSS in the issue titles.CVE-2019-149536.1JetBrains YouTrack versions before 2019.2.53938 had a possible XSS through issue attachments when using the Firefox browser.CVE-2019-149545.9JetBrains IntelliJ IDEA before 2019.2 was resolving the markdown plantuml artifact download link via a cleartext http connection.CVE-2019-149555.3In JetBrains Hub versions earlier than 2018.4.11436, there was no option to force a user to change the password and no password expiration p CVE-2019-149564.3JetBrains YouTrack before 2019.2.53938 was using incorrect settings, allowing a user without necessary permissions to get other project name