CVE-2020-8920lowCWE-285

CVE-2020-8920: falha de baixa gravidade em Gerrit

Overoptimization leads to private information leak in Gerrit

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Gerrit+ Monitorar com.google.gerrit:gerrit-plugin-api

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

8Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 3.5epss 0.4%
An information leak vulnerability exists in Gerrit versions prior to 2.14.22, 2.15.21, 2.16.25, 3.0.15, 3.1.10, 3.2.5 where an overoptimization with the FilteredRepository wrapper skips the verification of access on All-Users repositories, allowing an attacker to get read access to all users' personal information associated with their accounts.
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Produtos afetados
Gerrit · Gerrit
CVEs relacionadas — Gerrit

No mesmo produto, das mais perigosas para as menos.

CVE-2026-87722HIGHRegular Expression Denial of Service (ReDoS) in Search Query Predicates and REST Filter Endpoints in Gerrit Code ReviewEPSS 0.3%CVE-2026-87721HIGHDenial of Service via Exponential Backtracking in ANTLR Search Query Parser in Gerrit Code ReviewEPSS 0.3%CVE-2020-8919LOWInformation leakage in GerritEPSS 0.3%CVE-2026-87720HIGHIncorrect Authorization via Stale ProjectCache Eviction and Repeated .git Suffixes in Gerrit Code ReviewEPSS 0.3%CVE-2026-2725MEDIUMImproper Authorization in Gerrit allowing Code Review Bypass via "Submitted Together"EPSS 0.1%