CVEvulnerability

CVE-2020-5415

10.0 CRITICAL Published 2020-08-12 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2020-08-12
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
10.0 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
CVSS 3.0 ([email protected])
10.0 CRITICAL — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L
CVSS 2.0 ([email protected])
6.4 MEDIUM — AV:N/AC:L/Au:N/C:P/I:P/A:N
Weaknesses
CWE-290

Description

Concourse, versions prior to 6.3.1 and 6.4.1, in installations which use the GitLab auth connector, is vulnerable to identity spoofing by way of configuring a GitLab account with the same full name as another user who is granted access to a Concourse team. GitLab groups do not have this vulnerability, so GitLab users may be moved into groups which are then configured in the Concourse team.

Affected configurations

• pivotal software concourse (< 6.3.1) • pivotal software concourse (>= 6.4.0 < 6.4.1)

Related

Weakness · CWE (1)

  • CWE-290 Authentication Bypass by Spoofing weakness

References