CVE-2019-12430: Command Injection
Published Mar 10, 2020
·Updated
An issue was discovered in GitLab Community and Enterprise Edition 11.11. A specially crafted payload would allow an authenticated malicious user to execute commands remotely through the repository download feature. It allows Command Injection.
Affected Software
2 affected components
GitLab GitLab=11.11.0
GitLab GitLab=11.11.0
Event History
Mar 10, 2020
CVE Published
via MITRE·01:40 PM
Data Sourced
via MITRE·01:40 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2019-12430?
CVE-2019-12430 has a high severity rating due to its potential to allow remote command injection.
2
How do I fix CVE-2019-12430?
To fix CVE-2019-12430, upgrade to GitLab Community or Enterprise Edition version 11.11.1 or later.
3
Who is affected by CVE-2019-12430?
Users of GitLab Community and Enterprise Edition version 11.11.0 are affected by CVE-2019-12430.
4
What type of vulnerability is CVE-2019-12430?
CVE-2019-12430 is identified as a command injection vulnerability.
5
What can an attacker do with CVE-2019-12430?
An attacker can execute arbitrary commands on the server by exploiting the repository download feature in GitLab.