CVEvulnerability
CVE-2020-8920
3.5 LOW
Official page ↗
- Status
- Modified
- Published
- 2020-12-10
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 3.5 LOW — CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- CVSS 3.1 ([email protected])
- 3.5 LOW — CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- CVSS 2.0 ([email protected])
- 2.7 LOW — AV:A/AC:L/Au:S/C:P/I:N/A:N
- Weaknesses
- CWE-285
Description
An information leak vulnerability exists in Gerrit versions prior to 2.14.22, 2.15.21, 2.16.25, 3.0.15, 3.1.10, 3.2.5 where an overoptimization with the FilteredRepository wrapper skips the verification of access on All-Users repositories, allowing an attacker to get read access to all users' personal information associated with their accounts.
Affected configurations
• google gerrit (>= 2.14.0 < 2.14.22)
• google gerrit (>= 2.15.0 < 2.15.21)
• google gerrit (>= 2.16.0 < 2.16.25)
• google gerrit (>= 3.0.0 < 3.0.15)
• google gerrit (>= 3.1.0 < 3.1.10)
• google gerrit (>= 3.2.0 < 3.2.5)
Related
Weakness · CWE (1)
- CWE-285 Improper Authorization weakness
References
- https://gerrit.googlesource.com/gerrit/+/45071d6977932bca5a1427c8abad24710fed2e33 Issue Tracking, Patch, Vendor Advisory
- https://www.gerritcodereview.com/2.14.html#21422 Release Notes, Vendor Advisory
- https://www.gerritcodereview.com/2.15.html#21521 Release Notes, Vendor Advisory
- https://www.gerritcodereview.com/2.16.html#21625 Release Notes, Vendor Advisory
- https://www.gerritcodereview.com/3.0.html#3014 Release Notes, Vendor Advisory
- https://www.gerritcodereview.com/3.1.html#3110 Release Notes, Vendor Advisory
- https://www.gerritcodereview.com/3.2.html#325 Release Notes, Vendor Advisory
- https://gerrit.googlesource.com/gerrit/+/45071d6977932bca5a1427c8abad24710fed2e33 Issue Tracking, Patch, Vendor Advisory
- https://www.gerritcodereview.com/2.14.html#21422 Release Notes, Vendor Advisory
- https://www.gerritcodereview.com/2.15.html#21521 Release Notes, Vendor Advisory
- https://www.gerritcodereview.com/2.16.html#21625 Release Notes, Vendor Advisory
- https://www.gerritcodereview.com/3.0.html#3014 Release Notes, Vendor Advisory
- https://www.gerritcodereview.com/3.1.html#3110 Release Notes, Vendor Advisory
- https://www.gerritcodereview.com/3.2.html#325 Release Notes, Vendor Advisory