CVE-2020-5415: Authentication Bypass by Spoofing

December 20, 2021

Concourse, versions prior to 6.3.1 and 6.4.1, in installations which use the GitLab auth connector, is vulnerable to identity spoofing by way of configuring a GitLab account with the same full name as another user who is granted access to a Concourse team. GitLab groups do not have this vulnerability, so GitLab users may be moved into groups which are then configured in the Concourse team.

References

github.com/advisories/GHSA-627p-rr78-99rj
github.com/concourse/concourse/security/advisories/GHSA-627p-rr78-99rj
nvd.nist.gov/vuln/detail/CVE-2020-5415
tanzu.vmware.com/security/cve-2020-5415

Detect and mitigate CVE-2020-5415 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →