Vulnerability · Published Dec 10, 2020 · Assigned by Google
CVE-2020-8919Information leakage in Gerrit
Low 3.5
In plain English
A low-severity security flaw in Gerrit from Gerrit. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities).
Severity (CVSS 3.1)3.5Low
Exploit odds (30 days)0.3%top 74.8% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
An information leak vulnerability exists in Gerrit versions prior to 2.15.21, 2.16.25, 3.0.15, 3.1.10, 3.2.5 where a missing access check on the branch REST API allows an attacker with only the default set of priviledges to read all other user's personal account data as well as sub-trees with restricted access.
Affected products (as reported)
Weakness: CWE-285 · Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
References
- https://gerrit.googlesource.com/gerrit/+/0532fb876cb86bc091a91f78e6f28fff9e39ca65 x_refsource_CONFIRM
- https://www.gerritcodereview.com/2.15.html#21521 x_refsource_CONFIRM
- https://www.gerritcodereview.com/2.16.html#21625 x_refsource_CONFIRM
- https://www.gerritcodereview.com/3.0.html#3014 x_refsource_CONFIRM
- https://www.gerritcodereview.com/3.1.html#3110 x_refsource_CONFIRM
- https://www.gerritcodereview.com/3.2.html#325 x_refsource_CONFIRM