Overoptimization leads to private information leak in Gerrit
Priority LOW 17CWE-285Published · Updated
Key facts
- Attack vector
- Adjacent network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-285.
Summary
An information leak vulnerability exists in Gerrit versions prior to 2.14.22, 2.15.21, 2.16.25, 3.0.15, 3.1.10, 3.2.5 where an overoptimization with the FilteredRepository wrapper skips the verification of access on All-Users repositories, allowing an attacker to get read access to all users' personal information associated with their accounts.
Why it matters now
EPSS 0.00372 31st percentileScored 2026-11-07
Fix Fixed Gerrit (Gerrit): 2.14.22com.google.gerrit:gerrit-plugin-api (Maven): 2.14.22, 2.15.21, 2.16.25 +3
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Gerrit | stable to before 2.14.22 | 2.14.22 | Patch available | CNA | |
| — | com.google.gerrit:gerrit-plugin-api (Maven) | before 2.14.22 | 2.14.22 | Patch available | GHSA-g5q2-cxgq-h2rw |
| — | com.google.gerrit:gerrit-plugin-api (Maven) | 2.15.0 to before 2.15.21 | 2.15.21 | Patch available | GHSA-g5q2-cxgq-h2rw |
| — | com.google.gerrit:gerrit-plugin-api (Maven) | 2.16.0 to before 2.16.25 | 2.16.25 | Patch available | GHSA-g5q2-cxgq-h2rw |
| — | com.google.gerrit:gerrit-plugin-api (Maven) | 3.0.0 to before 3.0.15 | 3.0.15 | Patch available | GHSA-g5q2-cxgq-h2rw |
| — | com.google.gerrit:gerrit-plugin-api (Maven) | 3.1.0 to before 3.1.10 | 3.1.10 | Patch available | GHSA-g5q2-cxgq-h2rw |
| — | com.google.gerrit:gerrit-plugin-api (Maven) | 3.2.0 to before 3.2.5 | 3.2.5 | Patch available | GHSA-g5q2-cxgq-h2rw |
- Gerrit VendorGoogle Affected stable to before 2.14.22 Fixed in 2.14.22 Patch available CNA
- com.google.gerrit:gerrit-plugin-api (Maven) Vendor— Affected before 2.14.22 Fixed in 2.14.22 Patch available GHSA-g5q2-cxgq-h2rw
- com.google.gerrit:gerrit-plugin-api (Maven) Vendor— Affected 2.15.0 to before 2.15.21 Fixed in 2.15.21 Patch available GHSA-g5q2-cxgq-h2rw
- com.google.gerrit:gerrit-plugin-api (Maven) Vendor— Affected 2.16.0 to before 2.16.25 Fixed in 2.16.25 Patch available GHSA-g5q2-cxgq-h2rw
- com.google.gerrit:gerrit-plugin-api (Maven) Vendor— Affected 3.0.0 to before 3.0.15 Fixed in 3.0.15 Patch available GHSA-g5q2-cxgq-h2rw
- com.google.gerrit:gerrit-plugin-api (Maven) Vendor— Affected 3.1.0 to before 3.1.10 Fixed in 3.1.10 Patch available GHSA-g5q2-cxgq-h2rw
- com.google.gerrit:gerrit-plugin-api (Maven) Vendor— Affected 3.2.0 to before 3.2.5 Fixed in 3.2.5 Patch available GHSA-g5q2-cxgq-h2rw
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:google:gerrit:*:*:*:*:*:*:*:* | 2.14.0 to before 2.14.22; 2.15.0 to before 2.15.21; 2.16.0 to before 2.16.25; 3.0.0 to before 3.0.15; 3.1.0 to before 3.1.10; 3.2.0 to before 3.2.5 | Vulnerable |
- cpe:2.3:a:google:gerrit:*:*:*:*:*:*:*:* Versions 2.14.0 to before 2.14.22; 2.15.0 to before 2.15.21; 2.16.0 to before 2.16.25; 3.0.0 to before 3.0.15; 3.1.0 to before 3.1.10; 3.2.0 to before 3.2.5 Vulnerable ·Google
Remediation
- Fix · CNA Gerrit (Gerrit) Fixed in 2.14.22
- Fix · GHSA-g5q2-cxgq-h2rw com.google.gerrit:gerrit-plugin-api (Maven) Fixed in 2.14.22 Advisory →
- Fix · GHSA-g5q2-cxgq-h2rw com.google.gerrit:gerrit-plugin-api (Maven) Fixed in 2.15.21 Advisory →
- Fix · GHSA-g5q2-cxgq-h2rw com.google.gerrit:gerrit-plugin-api (Maven) Fixed in 2.16.25 Advisory →
- Fix · GHSA-g5q2-cxgq-h2rw com.google.gerrit:gerrit-plugin-api (Maven) Fixed in 3.0.15 Advisory →
- Fix · GHSA-g5q2-cxgq-h2rw com.google.gerrit:gerrit-plugin-api (Maven) Fixed in 3.1.10 Advisory →
- Fix · GHSA-g5q2-cxgq-h2rw com.google.gerrit:gerrit-plugin-api (Maven) Fixed in 3.2.5 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2020-8920
- 2026-10-03 Alias added: GHSA-g5q2-cxgq-h2rw
References
Advisory 7
- https://www.gerritcodereview.com/2.15.html#21521
- https://www.gerritcodereview.com/2.16.html#21625
- https://www.gerritcodereview.com/3.0.html#3014
- https://www.gerritcodereview.com/3.1.html#3110
- https://www.gerritcodereview.com/3.2.html#325
- https://www.gerritcodereview.com/2.14.html#21422
- https://nvd.nist.gov/vuln/detail/CVE-2020-8920
More Google Gerrit vulnerabilities
- TI-2026-02333 Improper Authorization in Gerrit allowing Code Review Bypass via "Submitted Together" CVSS 4.0MEDIUM 6.0
- TI-2021-05513 Heap Memory exhaustion in Gerrit CVSS 3.1HIGH 7.5
- TI-2020-07162 Information leakage in Gerrit CVSS 3.1LOW 3.5
Sources
- CVE-2020-8920 · CVE Program
- CVE-2020-8920 · NVD
- FIRST EPSS
- GHSA-g5q2-cxgq-h2rw · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences