PT-2020-18467 · Concourse+1 · Concourse+1

Published 2020-08-12 · Updated 2024-03-06 · CVE-2020-5415

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions Concourse versions prior to 6.3.1 and 6.4.1

Description The issue allows for identity spoofing by configuring a GitLab account with the same full name as another user who is granted access to a Concourse team. This is possible in installations that use the GitLab auth connector. The vulnerability can be exploited by having the full name listed under users in the team configuration or given to the --gitlab-user flag. GitLab groups are not affected by this issue.

Recommendations For Concourse versions prior to 6.3.1, update to version 6.3.1 or later. For Concourse versions prior to 6.4.1, update to version 6.4.1 or later. As a temporary workaround, consider moving GitLab users into groups and then configuring these groups in the Concourse team, as GitLab groups do not have this vulnerability. After upgrading to the fixed versions, switch each user from their full name to their username in the Concourse team configuration.

Fix

Authentication Bypass by Spoofing

Weakness Enumeration

CWE-290

Related Identifiers

BIT-CONCOURSE-2020-5415

CVE-2020-5415

GHSA-627P-RR78-99RJ

Affected Products

Concourse

Gitlab

References · 6

• https://github.com/concourse/concourse/security/advisories/GHSA-627p-rr78-99rj · Patch
• https://osv.dev/vulnerability/CVE-2020-5415 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-5415 · Security Note
• https://osv.dev/vulnerability/BIT-concourse-2020-5415 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-627p-rr78-99rj · Vendor Advisory
• https://tanzu.vmware.com/security/cve-2020-5415 · Note