CVE-2020-5415criticalCWE-290

CVE-2020-5415: critical vulnerability in VMware Tanzu Concourse

Concourse's GitLab auth allows impersonation

Published · Updated

Follow this CVE+ Monitor Concourse+ Monitor github.com/concourse/concourse

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 10epss 1.2%
Concourse, versions prior to 6.3.1 and 6.4.1, in installations which use the GitLab auth connector, is vulnerable to identity spoofing by way of configuring a GitLab account with the same full name as another user who is granted access to a Concourse team. GitLab groups do not have this vulnerability, so GitLab users may be moved into groups which are then configured in the Concourse team.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L
Affected products
VMware Tanzu · Concourse