CVSS 3.1
10.0 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:NCVE-2020-5415
Critical (10.0) in pivotal software concourse. EPSS 1.2% chance of exploitation in the next 30 days. Fixed in github.com/concourse/concourse 0.0.0-20200730151558-b00d1c8d8576, 1.6.1-0.20200730151558-b00d1c8d8576, 6.3.1.
Concourse, versions prior to 6.3.1 and 6.4.1, in installations which use the GitLab auth connector, is vulnerable to identity spoofing by way of configuring a GitLab account with the same full name as another user who is granted access to a Concourse team. GitLab groups do not have this vulnerability, so GitLab users may be moved into groups which are then configured in the Concourse team.
Severity
- EPSS
- 1.2% chance of exploitation in the next 30 days; higher than 68% of CVEs (scores of 2026-10-31)
- CWE
- CWE-290
- Published
- Modified
- Record from
- the NVD, synced
Affected
- pivotal_software:concourse
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-627p-rr78-99rj | Go | github.com/concourse/concourse | >=6.4.0 <6.4.1 | 6.4.1 |
| GHSA-627p-rr78-99rj | Go | github.com/concourse/concourse | >=1.6.1 <6.3.1 | 6.3.1 |
| GHSA-627p-rr78-99rj | Go | github.com/concourse/dex | >=6.4.0 <6.4.1 | 6.4.1 |
| GHSA-627p-rr78-99rj | Go | github.com/concourse/dex | >=0.0.0 <6.3.1 | 6.3.1 |
| GHSA-627p-rr78-99rj | Go | github.com/concourse/dex | <0.0.0-20200730150203-821b48abfd88 | 0.0.0-20200730150203-821b48abfd88 |
| GHSA-627p-rr78-99rj | Go | github.com/concourse/concourse | <0.0.0-20200730151558-b00d1c8d8576 | 0.0.0-20200730151558-b00d1c8d8576 |
| GHSA-627p-rr78-99rj | Go | github.com/concourse/concourse | >=0.0.0 <1.6.1-0.20200730151558-b00d1c8d8576 | 1.6.1-0.20200730151558-b00d1c8d8576 |