Information leakage in Gerrit
CVE-2020-8919

3.5LOW

Key Information:

Vendor

Gerrit

Status
Gerrit
Vendor
CVE Published:
10 December 2020

What is CVE-2020-8919?

An information leak vulnerability exists in Gerrit versions prior to 2.15.21, 2.16.25, 3.0.15, 3.1.10, 3.2.5 where a missing access check on the branch REST API allows an attacker with only the default set of priviledges to read all other user's personal account data as well as sub-trees with restricted access.

Affected Version(s)

Gerrit stable < 2.15.21

References

https://gerrit.googlesource.com/gerrit/+/0532fb876cb86bc0...
x_refsource_CONFIRM
https://www.gerritcodereview.com/2.15.html#21521
x_refsource_CONFIRM
https://www.gerritcodereview.com/2.16.html#21625
x_refsource_CONFIRM

CVSS V3.1

Score:
3.5
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.