CVE-2020-8920
Overoptimization leads to private information leak in Gerrit
- State
- Published
- Severity
- 3.5 Low
- Published
- Dec 10, 2020
- Updated
- Aug 4, 2024
- Reserved
- Feb 12, 2020
Description
An information leak vulnerability exists in Gerrit versions prior to 2.14.22, 2.15.21, 2.16.25, 3.0.15, 3.1.10, 3.2.5 where an overoptimization with the FilteredRepository wrapper skips the verification of access on All-Users repositories, allowing an attacker to get read access to all users' personal information associated with their accounts.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 3.5 Low | CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
Weaknesses
- CWE-285 Improper Authorization
Affected Products
| Product | Versions |
|---|---|
GerritGerrit |
|
References
- https://www.gerritcodereview.com/2.15.html#21521
- https://www.gerritcodereview.com/2.16.html#21625
- https://www.gerritcodereview.com/3.0.html#3014
- https://www.gerritcodereview.com/3.1.html#3110
- https://www.gerritcodereview.com/3.2.html#325
- https://gerrit.googlesource.com/gerrit/+/45071d6977932bca5a1427c8abad24710fed2e33
- https://www.gerritcodereview.com/2.14.html#21422
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.