Auth bypass in Gerrit
CVE-2020-8920
An information leak vulnerability exists in Gerrit versions prior to 2.14.22, 2.15.21, 2.16.25, 3.0.15, 3.1.10, 3.2.5 where an overoptimization with the FilteredRepository wrapper skips the verification of access on All-Users repositories…
EPSS: 0.001 (22.9th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 3.5 (Low). Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N.
Affected products
- Gerrit — versions stable
Weakness classification (CWE)
References
- www.gerritcodereview.com/2.15.html (x_refsource_CONFIRM)
- www.gerritcodereview.com/2.16.html (x_refsource_CONFIRM)
- www.gerritcodereview.com/3.0.html (x_refsource_CONFIRM)
- www.gerritcodereview.com/3.1.html (x_refsource_CONFIRM)
- www.gerritcodereview.com/3.2.html (x_refsource_CONFIRM)
- gerrit.googlesource.com/gerrit/+/45071d6977932bca5a1427c8abad24710fed2e33 (x_refsource_CONFIRM)
- www.gerritcodereview.com/2.14.html (x_refsource_CONFIRM)
Frequently asked questions
- What is CVE-2020-8920?
- CVE-2020-8920 is a low-severity vulnerability in Gerrit, classified under Improper Authorization. CVSS score: 3.5/10. Published 2020-12-10.
- How severe is CVE-2020-8920?
- Low severity. CVSS v3 base score is 3.5 out of 10.