CVE-2020-8919

Information leakage in Gerrit

LOW

3.5

CVSS Score

Published: December 10, 2020 at 10:15 AM UTC

Updated: June 17, 2026 at 03:27 AM UTC

2 products affected across 2 vendorsGerritGerrit

Using Gerrit by Gerrit?

Get instant alerts when new vulnerabilities affect Gerrit - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

LOW3.5

Exploit prediction

EPSS 0.3%

Description

An information leak vulnerability exists in Gerrit versions prior to 2.15.21, 2.16.25, 3.0.15, 3.1.10, 3.2.5 where a missing access check on the branch REST API allows an attacker with only the default set of priviledges to read all other user's personal account data as well as sub-trees with restricted access.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Gerrit · Google

95%

2.15.0 ≤ v < 2.15.212.16.0 ≤ v < 2.16.253.0.0 ≤ v < 3.0.153.1.0 ≤ v < 3.1.103.2.0 ≤ v < 3.2.5

Affected range stops below 2.15.21, so it looks safe — our inference, not a vendor statement

Affected range stops below 2.16.25, so it looks safe — our inference, not a vendor statement

Affected range stops below 3.0.15, so it looks safe — our inference, not a vendor statement

Affected range stops below 3.1.10, so it looks safe — our inference, not a vendor statement

Affected range stops below 3.2.5, so it looks safe — our inference, not a vendor statement

Gerrit · Gerrit

60%

stable ≤ v < 2.15.21stable

Affected range stops below 2.15.21, so it looks safe — our inference, not a vendor statement

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references