CVE-2020-5415 CRITICAL

CVE-2020-5415: Concourse's GitLab auth allows impersonation

Vendor Vmware Tanzu
Product Concourse
Weakness CWE-290
Published August 12, 2020
Last update September 16, 2024
View on NVD All CVEs

CVSS base score

10.0/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L

What the vulnerability does

01Description

Concourse, versions prior to 6.3.1 and 6.4.1, in installations which use the GitLab auth connector, is vulnerable to identity spoofing by way of configuring a GitLab account with the same full name as another user who is granted access to a Concourse team. GitLab groups do not have this vulnerability, so GitLab users may be moved into groups which are then configured in the Concourse team.

Key dates

02Disclosure timeline

August 12, 2020 CVE published
September 16, 2024 Record updated