Authorization Bypass Vulnerability in Concourse by Concourse CI
CVE-2022-31683

5.4MEDIUM

Key Information:

Vendor

Pivotal Software

Status
Concourse
Vendor
CVE Published:
19 December 2022

What is CVE-2022-31683?

The Concourse CI server suffers from an authorization bypass vulnerability, allowing users to manipulate team parameters in requests. Specifically, a Concourse user can construct a request with a specific body parameter (e.g., :team_name=team2) that enables them to bypass team scope checks, potentially granting access to restricted resources across different teams. This vulnerability poses significant risks as it can lead to unauthorized resource access, impacting the integrity and confidentiality of team activities within the Concourse CI environment.

Affected Version(s)

Concourse Concourse (7.x.y prior to 7.8.3 and 6.x.y prior to 6.7.9)

References

https://github.com/concourse/concourse/security/advisorie...

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.