What’s Vulnerable › Vulnerabilities
CVE-2020-8919: Information leakage in Gerrit
- Severity: low (CVSS 3.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2020-12-10 · updated 2026-06-17
- Weakness: CWE-285
Description
An information leak vulnerability exists in Gerrit versions prior to 2.15.21, 2.16.25, 3.0.15, 3.1.10, 3.2.5 where a missing access check on the branch REST API allows an attacker with only the default set of priviledges to read all other user's personal account data as well as sub-trees with restricted access.
Affected products
- Gerrit: from 2.15.0 before 2.15.21; from 2.16.0 before 2.16.25; from 3.0.0 before 3.0.15; from 3.1.0 before 3.1.10; from 3.2.0 before 3.2.5 — fixed in 2.15.21, 2.16.25, 3.0.15, 3.1.10, 3.2.5
How to fix
Upgrade to a fixed version: Gerrit 2.15.21, 2.16.25, 3.0.15, 3.1.10. Check the vendor advisory for mitigations.
References
- https://gerrit.googlesource.com/gerrit/+/0532fb876cb86bc091a91f78e6f28fff9e39ca65
- https://www.gerritcodereview.com/2.15.html#21521
- https://www.gerritcodereview.com/2.16.html#21625
- https://www.gerritcodereview.com/3.0.html#3014
- https://www.gerritcodereview.com/3.1.html#3110
- https://www.gerritcodereview.com/3.2.html#325
- https://gerrit.googlesource.com/gerrit/+/0532fb876cb86bc091a91f78e6f28fff9e39ca65
- https://www.gerritcodereview.com/2.15.html#21521
- https://www.gerritcodereview.com/2.16.html#21625
- https://www.gerritcodereview.com/3.0.html#3014
- https://www.gerritcodereview.com/3.1.html#3110
- https://www.gerritcodereview.com/3.2.html#325
Get alerted when CVE-2020-8919 or the next vulnerability affects your stack