CVE-2020-5415
Critical
Description
Concourse, versions prior to 6.3.1 and 6.4.1, in installations which use the GitLab auth connector, is vulnerable to identity spoofing by way of configuring a GitLab account with the same full name as another user who is granted access to a Concourse team. GitLab groups do not have this vulnerability, so GitLab users may be moved into groups which are then configured in the Concourse team.
SeverityCritical
CVSS10.0
Exploit probability—
ProductPivotal Software Concourse
PublishedAug 12, 2020
First seenAug 12, 2020
Weakness typeCWE-290CWE-290
How to fix
Update
- pivotal_software concourse6.3.1, 6.4.1 or later
- github.com/concourse/concourse6.4.1, 6.3.1, 0.0.0-20200730151558-b00d1c8d8576, 1.6.1-0.20200730151558-b00d1c8d8576 or later
- github.com/concourse/dex6.4.1, 6.3.1, 0.0.0-20200730150203-821b48abfd88 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pivotal_software concourse | v < 6.3.1, 6.4.0 ≤ v < 6.4.1 | 6.3.1, 6.4.1 |
| github.com/concourse/concourseGo | 6.4.0 ≤ v < 6.4.1, 1.6.1 ≤ v < 6.3.1, v < 0.0.0-20200730151558-b00d1c8d8576, 0.0.0 ≤ v < 1.6.1-0.20200730151558-b00d1c8d8576 | 6.4.1, 6.3.1, 0.0.0-20200730151558-b00d1c8d8576, 1.6.1-0.20200730151558-b00d1c8d8576 |
| github.com/concourse/dexGo | 6.4.0 ≤ v < 6.4.1, 0.0.0 ≤ v < 6.3.1, v < 0.0.0-20200730150203-821b48abfd88 | 6.4.1, 6.3.1, 0.0.0-20200730150203-821b48abfd88 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.