CVE-2020-8920
LOWGerrit < 2.14.22/2.15.21/2.16.25/3.0.15/3.1.10/3.2.5 - Unauthenticated Information Leak
Title source: llmDescription
An information leak vulnerability exists in Gerrit versions prior to 2.14.22, 2.15.21, 2.16.25, 3.0.15, 3.1.10, 3.2.5 where an overoptimization with the FilteredRepository wrapper skips the verification of access on All-Users repositories, allowing an attacker to get read access to all users' personal information associated with their accounts.
References (7)
Core 7
Core References
Release Notes, Vendor Advisory x_refsource_confirm
https://www.gerritcodereview.com/2.15.html#21521
Release Notes, Vendor Advisory x_refsource_confirm
https://www.gerritcodereview.com/2.16.html#21625
Release Notes, Vendor Advisory x_refsource_confirm
https://www.gerritcodereview.com/3.0.html#3014
Release Notes, Vendor Advisory x_refsource_confirm
https://www.gerritcodereview.com/3.1.html#3110
Release Notes, Vendor Advisory x_refsource_confirm
https://www.gerritcodereview.com/3.2.html#325
Issue Tracking, Patch, Vendor Advisory x_refsource_confirm
https://gerrit.googlesource.com/gerrit/+/45071d6977932bca5a1427c8abad24710fed2e33
Release Notes, Vendor Advisory x_refsource_confirm
https://www.gerritcodereview.com/2.14.html#21422
Scores
CVSS v3
3.5
EPSS
0.0037
EPSS Percentile
28.4%
Attack Vector
ADJACENT_NETWORK
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Details
CWE
CWE-285
Status
published
Products (2)
com.google.gerrit/gerrit-plugin-api
0 - 2.14.22Maven
google/gerrit
2.14.0 - 2.14.22
Published
Dec 10, 2020
Tracked Since
Feb 18, 2026