CVE-2020-8920
Summary
| CVE | CVE-2020-8920 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2020-12-10 11:15:00 UTC |
| Updated | 2021-10-07 17:08:00 UTC |
| Description | An information leak vulnerability exists in Gerrit versions prior to 2.14.22, 2.15.21, 2.16.25, 3.0.15, 3.1.10, 3.2.5 where an overoptimization with the FilteredRepository wrapper skips the verification of access on All-Users repositories, allowing an attacker to get read access to all users' personal information associated with their accounts. |
Risk And Classification
Problem Types: NVD-CWE-Other
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Gerrit 3.2.0 Release | Gerrit Code Review | CONFIRM | www.gerritcodereview.com | Release Notes, Vendor Advisory |
| Gerrit 2.16 Release | Gerrit Code Review | CONFIRM | www.gerritcodereview.com | Release Notes, Vendor Advisory |
| 45071d6977932bca5a1427c8abad24710fed2e33 - gerrit - Git at Google | CONFIRM | gerrit.googlesource.com | Issue Tracking, Patch, Vendor Advisory |
| Gerrit 2.14 Release | Gerrit Code Review | CONFIRM | www.gerritcodereview.com | Release Notes, Vendor Advisory |
| Gerrit 3.1.0 Release (in development) | Gerrit Code Review | CONFIRM | www.gerritcodereview.com | Release Notes, Vendor Advisory |
| Gerrit 2.15 Release | Gerrit Code Review | CONFIRM | www.gerritcodereview.com | Release Notes, Vendor Advisory |
| Gerrit 3.0.0 Release | Gerrit Code Review | CONFIRM | www.gerritcodereview.com | Release Notes, Vendor Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 996712 Java (Maven) Security Update for com.google.gerrit:gerrit-plugin-api (GHSA-g5q2-cxgq-h2rw)