Description (CNA)
Concourse, versions prior to 6.3.1 and 6.4.1, in installations which use the GitLab auth connector, is vulnerable to identity spoofing by way of configuring a GitLab account with the same full name as another user who is granted access to a Concourse team. GitLab groups do not have this vulnerability, so GitLab users may be moved into groups which are then configured in the Concourse team.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| VMware Tanzu / Concourse | affected 6.4 before 6.4.1; affected 6.3 before 6.3.1 |
CWE
CWE-290
References
- https://github.com/concourse/concourse/security/advisories/GHSA-627p-rr78-99rj
- https://tanzu.vmware.com/security/cve-2020-5415
ADP enrichment
No English description supplied.