CVE-2020-5415criticalCWE-290

CVE-2020-5415: fallo crítico en VMware Tanzu Concourse

Concourse's GitLab auth allows impersonation

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Concourse+ Monitorear github.com/concourse/concourse

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

28Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 10epss 1.2%
Concourse, versions prior to 6.3.1 and 6.4.1, in installations which use the GitLab auth connector, is vulnerable to identity spoofing by way of configuring a GitLab account with the same full name as another user who is granted access to a Concourse team. GitLab groups do not have this vulnerability, so GitLab users may be moved into groups which are then configured in the Concourse team.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L
Productos afectados
VMware Tanzu · Concourse