medium5.4
CVE-2022-31683
Concourse (7.x.y prior to 7.8.3 and 6.x.y prior to 6.7.9) contains an authorization bypass issue.
Impact
Concourse (7.x.y prior to 7.8.3 and 6.x.y prior to 6.7.9) contains an authorization bypass issue. A Concourse user can send a request with body including :team_name=team2 to bypass team scope check to gain access to certain resources belong to any other team.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Pivotal Software | Concourse | from 6.0.0 before 6.7.9 from 7.0.0 before 7.8.3 |