Gerrit
Monthly
Incorrect authorization in Gerrit's 'submitted together' feature (versions 2.12 and later) allows an authenticated attacker holding force push permissions on a secondary branch to bypass mandatory code review and inject unapproved commits into restricted branches. By crafting a submission whose 'topic' tag matches that of an existing unapproved change targeting a protected branch, the attacker exploits the grouped-submission mechanism to smuggle unauthorized code past governance controls. A proof-of-concept is acknowledged in the SSVC assessment; however, EPSS sits at 0.03% (9th percentile) and exploitation is flagged as non-automatable, indicating targeted rather than widespread opportunistic abuse.
Any git operation is passed through Jetty and a session is created. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An information leak vulnerability exists in Gerrit versions prior to 2.14.22, 2.15.21, 2.16.25, 3.0.15, 3.1.10, 3.2.5 where an overoptimization with the FilteredRepository wrapper skips the. Rated low severity (CVSS 3.5), this vulnerability is low attack complexity.
An information leak vulnerability exists in Gerrit versions prior to 2.15.21, 2.16.25, 3.0.15, 3.1.10, 3.2.5 where a missing access check on the branch REST API allows an attacker with only the. Rated low severity (CVSS 3.5), this vulnerability is low attack complexity.
Incorrect authorization in Gerrit's 'submitted together' feature (versions 2.12 and later) allows an authenticated attacker holding force push permissions on a secondary branch to bypass mandatory code review and inject unapproved commits into restricted branches. By crafting a submission whose 'topic' tag matches that of an existing unapproved change targeting a protected branch, the attacker exploits the grouped-submission mechanism to smuggle unauthorized code past governance controls. A proof-of-concept is acknowledged in the SSVC assessment; however, EPSS sits at 0.03% (9th percentile) and exploitation is flagged as non-automatable, indicating targeted rather than widespread opportunistic abuse.
Any git operation is passed through Jetty and a session is created. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An information leak vulnerability exists in Gerrit versions prior to 2.14.22, 2.15.21, 2.16.25, 3.0.15, 3.1.10, 3.2.5 where an overoptimization with the FilteredRepository wrapper skips the. Rated low severity (CVSS 3.5), this vulnerability is low attack complexity.
An information leak vulnerability exists in Gerrit versions prior to 2.15.21, 2.16.25, 3.0.15, 3.1.10, 3.2.5 where a missing access check on the branch REST API allows an attacker with only the. Rated low severity (CVSS 3.5), this vulnerability is low attack complexity.