Concourse's GitLab auth allows impersonation
Priority MEDIUM 45CWE-290Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-290.
Summary
Concourse, versions prior to 6.3.1 and 6.4.1, in installations which use the GitLab auth connector, is vulnerable to identity spoofing by way of configuring a GitLab account with the same full name as another user who is granted access to a Concourse team. GitLab groups do not have this vulnerability, so GitLab users may be moved into groups which are then configured in the Concourse team.
Why it matters now
EPSS 0.01217 68th percentileScored 2026-11-07
Fix Fixed Concourse (VMware Tanzu): 6.4.1, 6.3.1github.com/concourse/concourse (Go): 6.4.1, 6.3.1, 0.0.0-20200730151558-b00d1c8d8576 +1+1 more product
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| VMware | Concourse | 6.4 to before 6.4.1; 6.3 to before 6.3.1 | 6.4.1, 6.3.1 | Patch available | CNA |
| — | github.com/concourse/concourse (Go) | 6.4.0 to before 6.4.1 | 6.4.1 | Patch available | GHSA-627p-rr78-99rj |
| — | github.com/concourse/concourse (Go) | 1.6.1 to before 6.3.1 | 6.3.1 | Patch available | GHSA-627p-rr78-99rj |
| — | github.com/concourse/dex (Go) | 6.4.0 to before 6.4.1 | 6.4.1 | Patch available | GHSA-627p-rr78-99rj |
| — | github.com/concourse/dex (Go) | 0.0.0 to before 6.3.1 | 6.3.1 | Patch available | GHSA-627p-rr78-99rj |
| — | github.com/concourse/dex (Go) | before 0.0.0-20200730150203-821b48abfd88 | 0.0.0-20200730150203-821b48abfd88 | Patch available | GHSA-627p-rr78-99rj |
| — | github.com/concourse/concourse (Go) | before 0.0.0-20200730151558-b00d1c8d8576 | 0.0.0-20200730151558-b00d1c8d8576 | Patch available | GHSA-627p-rr78-99rj |
| — | github.com/concourse/concourse (Go) | 0.0.0 to before 1.6.1-0.20200730151558-b00d1c8d8576 | 1.6.1-0.20200730151558-b00d1c8d8576 | Patch available | GHSA-627p-rr78-99rj |
- Concourse VendorVMware Affected 6.4 to before 6.4.1; 6.3 to before 6.3.1 Fixed in 6.4.1, 6.3.1 Patch available CNA
- github.com/concourse/concourse (Go) Vendor— Affected 6.4.0 to before 6.4.1 Fixed in 6.4.1 Patch available GHSA-627p-rr78-99rj
- github.com/concourse/concourse (Go) Vendor— Affected 1.6.1 to before 6.3.1 Fixed in 6.3.1 Patch available GHSA-627p-rr78-99rj
- github.com/concourse/dex (Go) Vendor— Affected 6.4.0 to before 6.4.1 Fixed in 6.4.1 Patch available GHSA-627p-rr78-99rj
- github.com/concourse/dex (Go) Vendor— Affected 0.0.0 to before 6.3.1 Fixed in 6.3.1 Patch available GHSA-627p-rr78-99rj
- github.com/concourse/dex (Go) Vendor— Affected before 0.0.0-20200730150203-821b48abfd88 Fixed in 0.0.0-20200730150203-821b48abfd88 Patch available GHSA-627p-rr78-99rj
- github.com/concourse/concourse (Go) Vendor— Affected before 0.0.0-20200730151558-b00d1c8d8576 Fixed in 0.0.0-20200730151558-b00d1c8d8576 Patch available GHSA-627p-rr78-99rj
- github.com/concourse/concourse (Go) Vendor— Affected 0.0.0 to before 1.6.1-0.20200730151558-b00d1c8d8576 Fixed in 1.6.1-0.20200730151558-b00d1c8d8576 Patch available GHSA-627p-rr78-99rj
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:pivotal_software:concourse:*:*:*:*:*:*:*:* | before 6.3.1; 6.4.0 to before 6.4.1 | Vulnerable | Spring by Pivotal |
- cpe:2.3:a:pivotal_software:concourse:*:*:*:*:*:*:*:* Versions before 6.3.1; 6.4.0 to before 6.4.1 Vulnerable ·Spring by Pivotal
Remediation
- Fix · CNA Concourse (VMware Tanzu) Fixed in 6.4.1, 6.3.1
- Fix · GHSA-627p-rr78-99rj github.com/concourse/concourse (Go) Fixed in 6.4.1 Advisory →
- Fix · GHSA-627p-rr78-99rj github.com/concourse/concourse (Go) Fixed in 6.3.1 Advisory →
- Fix · GHSA-627p-rr78-99rj github.com/concourse/dex (Go) Fixed in 6.4.1 Advisory →
- Fix · GHSA-627p-rr78-99rj github.com/concourse/dex (Go) Fixed in 6.3.1 Advisory →
- Fix · GHSA-627p-rr78-99rj github.com/concourse/dex (Go) Fixed in 0.0.0-20200730150203-821b48abfd88 Advisory →
- Fix · GHSA-627p-rr78-99rj github.com/concourse/concourse (Go) Fixed in 0.0.0-20200730151558-b00d1c8d8576 Advisory →
- Fix · GHSA-627p-rr78-99rj github.com/concourse/concourse (Go) Fixed in 1.6.1-0.20200730151558-b00d1c8d8576 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2020-5415
- 2026-10-03 Alias added: GHSA-627p-rr78-99rj
References
More VMware vulnerabilities
- TI-2026-42442 vCenter directory-traversal vulnerability KEVCVSS 3.1CRITICAL 9.8
- TI-2024-26040 Privilege escalation in VMware vCenter Server KEVCVSS 3.1CRITICAL 9.8
- TI-2024-26039 Heap-overflow in VMware vCenter Server KEVCVSS 3.1CRITICAL 9.8
- TI-2024-24610 Out-of-bounds write in VMware vCenter Server KEVCVSS 3.1CRITICAL 9.8
- TI-2023-16914 VMware vCenter Server Out-of-Bounds Write Vulnerability KEVCVSS 3.1CRITICAL 9.8
- TI-2023-07303 Command injection in Aria Operations for Networks KEVCVSS 3.1CRITICAL 9.8
Sources
- CVE-2020-5415 · CVE Program
- CVE-2020-5415 · NVD
- FIRST EPSS
- GHSA-627p-rr78-99rj · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences