CVE-2020-8920
published 2020-12-10CVE-2020-8920: An information leak vulnerability exists in Gerrit versions prior to 2.14.22, 2.15.21, 2.16.25, 3.0.15, 3.1.10, 3.2.5 where an overoptimization with the…
PriorityP415low3.5CVSS 3.1
AVAACLPRLUINSUCLINAN
EPSS
0.37%
28.9th percentile
An information leak vulnerability exists in Gerrit versions prior to 2.14.22, 2.15.21, 2.16.25, 3.0.15, 3.1.10, 3.2.5 where an overoptimization with the FilteredRepository wrapper skips the verification of access on All-Users repositories, allowing an attacker to get read access to all users' personal information associated with their accounts.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| gerrit | gerrit | >= stable < 2.14.22 | 2.14.22 |
| gerrit | >= 2.14.0 < 2.14.22 | 2.14.22 | |
| gerrit | >= 2.15.0 < 2.15.21 | 2.15.21 | |
| gerrit | >= 2.16.0 < 2.16.25 | 2.16.25 | |
| gerrit | >= 3.0.0 < 3.0.15 | 3.0.15 | |
| gerrit | >= 3.1.0 < 3.1.10 | 3.1.10 | |
| gerrit | >= 3.2.0 < 3.2.5 | 3.2.5 |
CVSS provenance
nvdv3.13.5LOWCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
nvdv2.02.7LOWAV:A/AC:L/Au:S/C:P/I:N/A:N
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Information leak in Gerrit
ghsa·2022-05-24
CVE-2020-8920 [LOW] CWE-863 Information leak in Gerrit
Information leak in Gerrit
An information leak vulnerability exists in Gerrit versions prior to 2.14.22, 2.15.21, 2.16.25, 3.0.15, 3.1.10, 3.2.5 where an overoptimization with the FilteredRepository wrapper skips the verification of access on All-Users repositories, allowing an attacker to get read access to all users' personal information associated with their accounts.
OSV
Information leak in Gerrit
osv·2022-05-24
CVE-2020-8920 [LOW] Information leak in Gerrit
Information leak in Gerrit
An information leak vulnerability exists in Gerrit versions prior to 2.14.22, 2.15.21, 2.16.25, 3.0.15, 3.1.10, 3.2.5 where an overoptimization with the FilteredRepository wrapper skips the verification of access on All-Users repositories, allowing an attacker to get read access to all users' personal information associated with their accounts.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://gerrit.googlesource.com/gerrit/+/45071d6977932bca5a1427c8abad24710fed2e33https://www.gerritcodereview.com/2.14.html#21422https://www.gerritcodereview.com/2.15.html#21521https://www.gerritcodereview.com/2.16.html#21625https://www.gerritcodereview.com/3.0.html#3014https://www.gerritcodereview.com/3.1.html#3110https://www.gerritcodereview.com/3.2.html#325https://gerrit.googlesource.com/gerrit/+/45071d6977932bca5a1427c8abad24710fed2e33https://www.gerritcodereview.com/2.14.html#21422https://www.gerritcodereview.com/2.15.html#21521https://www.gerritcodereview.com/2.16.html#21625https://www.gerritcodereview.com/3.0.html#3014https://www.gerritcodereview.com/3.1.html#3110https://www.gerritcodereview.com/3.2.html#325
2020-12-10
Published