What’s Vulnerable › Vulnerabilities
CVE-2020-8920: Overoptimization leads to private information leak in Gerrit
- Severity: low (CVSS 3.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2020-12-10 · updated 2026-06-17
- Weakness: CWE-285
Description
An information leak vulnerability exists in Gerrit versions prior to 2.14.22, 2.15.21, 2.16.25, 3.0.15, 3.1.10, 3.2.5 where an overoptimization with the FilteredRepository wrapper skips the verification of access on All-Users repositories, allowing an attacker to get read access to all users' personal information associated with their accounts.
Affected products
- Gerrit: from 2.14.0 before 2.14.22; from 2.15.0 before 2.15.21; from 2.16.0 before 2.16.25; from 3.0.0 before 3.0.15; from 3.1.0 before 3.1.10; from 3.2.0 before 3.2.5 — fixed in 2.14.22, 2.15.21, 2.16.25, 3.0.15, 3.1.10, 3.2.5
How to fix
Upgrade to a fixed version: Gerrit 2.14.22, 2.15.21, 2.16.25, 3.0.15. Check the vendor advisory for mitigations.
References
- https://gerrit.googlesource.com/gerrit/+/45071d6977932bca5a1427c8abad24710fed2e33
- https://www.gerritcodereview.com/2.14.html#21422
- https://www.gerritcodereview.com/2.15.html#21521
- https://www.gerritcodereview.com/2.16.html#21625
- https://www.gerritcodereview.com/3.0.html#3014
- https://www.gerritcodereview.com/3.1.html#3110
- https://www.gerritcodereview.com/3.2.html#325
- https://gerrit.googlesource.com/gerrit/+/45071d6977932bca5a1427c8abad24710fed2e33
- https://www.gerritcodereview.com/2.14.html#21422
- https://www.gerritcodereview.com/2.15.html#21521
- https://www.gerritcodereview.com/2.16.html#21625
- https://www.gerritcodereview.com/3.0.html#3014
Get alerted when CVE-2020-8920 or the next vulnerability affects your stack