Gerrit up to 3.2.4 REST API improper authorization

Summaryinfo

A vulnerability was found in Gerrit up to 2.15.20/2.16.24/3.0.14/3.1.9/3.2.4 and classified as critical. Affected by this issue is some unknown functionality of the component REST API. The manipulation results in improper authorization. This vulnerability is reported as CVE-2020-8919. The attacker must have access to the local network to execute the attack. No exploit exists. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in Gerrit up to 2.15.20/2.16.24/3.0.14/3.1.9/3.2.4. It has been classified as problematic. Affected is an unknown code of the component REST API. The manipulation with an unknown input leads to a improper authorization vulnerability. CWE is classifying the issue as CWE-285. The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. This is going to have an impact on confidentiality.

The weakness was disclosed 12/11/2020. The advisory is available at gerrit.googlesource.com. This vulnerability is traded as CVE-2020-8919. The technical details are unknown and an exploit is not available. This vulnerability is assigned to T1548.002 by the MITRE ATT&CK project.

Upgrading to version 2.15.21, 2.16.25, 3.0.15, 3.1.10 or 3.2.5 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Name

• Gerrit

Version

• 2.15.0
• 2.15.1
• 2.15.2
• 2.15.3
• 2.15.4
• 2.15.5
• 2.15.6
• 2.15.7
• 2.15.8
• 2.15.9
• 2.15.10
• 2.15.11
• 2.15.12
• 2.15.13
• 2.15.14
• 2.15.15
• 2.15.16
• 2.15.17
• 2.15.18
• 2.15.19
• 2.15.20
• 2.16.0
• 2.16.1
• 2.16.2
• 2.16.3
• 2.16.4
• 2.16.5
• 2.16.6
• 2.16.7
• 2.16.8
• 2.16.9
• 2.16.10
• 2.16.11
• 2.16.12
• 2.16.13
• 2.16.14
• 2.16.15
• 2.16.16
• 2.16.17
• 2.16.18
• 2.16.19
• 2.16.20
• 2.16.21
• 2.16.22
• 2.16.23
• 2.16.24
• 3.0.0
• 3.0.1
• 3.0.2
• 3.0.3
• 3.0.4
• 3.0.5
• 3.0.6
• 3.0.7
• 3.0.8
• 3.0.9
• 3.0.10
• 3.0.11
• 3.0.12
• 3.0.13
• 3.0.14
• 3.1.0
• 3.1.1
• 3.1.2
• 3.1.3
• 3.1.4
• 3.1.5
• 3.1.6
• 3.1.7
• 3.1.8
• 3.1.9
• 3.2.0
• 3.2.1
• 3.2.2
• 3.2.3
• 3.2.4

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion