PT-2020-20370 · Google · Gerrit

Luca Milanesio · Published 2020-12-10 · Updated 2022-05-24 · CVE-2020-8920

Positive Technologies (AI Summary)

CVSS v3.1

3.5

Low

Base vector

AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Gerrit versions prior to 2.14.22 Gerrit versions prior to 2.15.21 Gerrit versions prior to 2.16.25 Gerrit versions prior to 3.0.15 Gerrit versions prior to 3.1.10 Gerrit versions prior to 3.2.5

Description An information leak issue exists where an overoptimization with the FilteredRepository wrapper skips the verification of access on All-Users repositories, allowing an attacker to get read access to all users' personal information associated with their accounts.

Recommendations For versions prior to 2.14.22, update to version 2.14.22 or later. For versions prior to 2.15.21, update to version 2.15.21 or later. For versions prior to 2.16.25, update to version 2.16.25 or later. For versions prior to 3.0.15, update to version 3.0.15 or later. For versions prior to 3.1.10, update to version 3.1.10 or later. For versions prior to 3.2.5, update to version 3.2.5 or later.

Fix

Improper Authorization

Incorrect Authorization

Weakness Enumeration

CWE-285

CWE-863

Related Identifiers

CVE-2020-8920

GHSA-G5Q2-CXGQ-H2RW

Affected Products

Gerrit

References · 37

• https://gerritcodereview.com/3.1.html#3110 · Vendor Advisory
• https://gerritcodereview.com/2.14.html#21422 · Vendor Advisory
• https://gerritcodereview.com/2.15.html#21521 · Vendor Advisory
• https://gerrit.googlesource.com/gerrit/+/45071d6977932bca5a1427c8abad24710fed2e33 · Vendor Advisory
• https://gerritcodereview.com/3.2.html#325 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-8920 · Security Note
• https://osv.dev/vulnerability/CVE-2020-8920 · Vendor Advisory
• https://gerritcodereview.com/2.16.html#21625 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-g5q2-cxgq-h2rw · Vendor Advisory
• https://gerritcodereview.com/3.0.html#3014 · Vendor Advisory
• https://t.me/cibsecurity/19056 · Telegram Post
• https://t.me/cibsecurity/18883 · Telegram Post
• https://t.me/cibsecurity/19228 · Telegram Post
• https://t.me/cibsecurity/18903 · Telegram Post
• https://t.me/cibsecurity/19267 · Telegram Post