Authorization

2022-12-1916:15:00

PRIOn knowledge base

www.prio-n.com

concourse

authorization bypass

version 7.x.y

version 6.x.y

team scope

security issue

5.6 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

23.5%

JSON

Concourse (7.x.y prior to 7.8.3 and 6.x.y prior to 6.7.9) contains an authorization bypass issue. A Concourse user can send a request with body including :team_name=team2 to bypass team scope check to gain access to certain resources belong to any other team.

CPENameOperatorVersion
concoursege7.0.0
concourselt7.8.3
concoursege6.0.0
concourselt6.7.9

Name	Operator	Version
concourse	ge	7.0.0
concourse	lt	7.8.3
concourse	ge	6.0.0
concourse	lt	6.7.9

References

github.com/concourse/concourse/security/advisories/GHSA-5jp2-vwrj-99rf