CVE-2020-8920
Overoptimization leads to private information leak in Gerrit
Vexday Risk Score
8Baixo
Decisão SSVC (CISA)
Track
Sem sinal de exploração → monitorar
CVSS 3.5EPSS 0.4%KEV nãoPoC —Nuclei —Metasploit —Patch —
Ciclo de vida
10 dez 2020Publicada no NVD
Recomendação: Monitorar — sem sinal de exploração no momento.
An information leak vulnerability exists in Gerrit versions prior to 2.14.22, 2.15.21, 2.16.25, 3.0.15, 3.1.10, 3.2.5 where an overoptimization with the FilteredRepository wrapper skips the verification of access on All-Users repositories, allowing an attacker to get read access to all users' personal information associated with their accounts.
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Produtos afetados
Gerrit · GerritQuer saber se a sua infraestrutura está exposta a isto?
Falar com a TrueHacking →Referências
https://gerrit.googlesource.com/gerrit/+/45071d6977932bca5a1427c8abad24710fed2e33https://www.gerritcodereview.com/2.14.html#21422https://www.gerritcodereview.com/2.15.html#21521https://www.gerritcodereview.com/2.16.html#21625https://www.gerritcodereview.com/3.0.html#3014https://www.gerritcodereview.com/3.1.html#3110https://www.gerritcodereview.com/3.2.html#325