What’s Vulnerable › Vulnerabilities

CVE-2022-31683

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-12-19 · updated 2026-06-17
• Weakness: CWE-639

Description

Concourse (7.x.y prior to 7.8.3 and 6.x.y prior to 6.7.9) contains an authorization bypass issue. A Concourse user can send a request with body including :team_name=team2 to bypass team scope check to gain access to certain resources belong to any other team.

Affected products

• Pivotal Concourse: from 6.0.0 before 6.7.9; from 7.0.0 before 7.8.3 — fixed in 6.7.9, 7.8.3

How to fix

Upgrade to a fixed version: Pivotal Concourse 6.7.9, 7.8.3. Check the vendor advisory for mitigations.

References

• https://github.com/concourse/concourse/security/advisories/GHSA-5jp2-vwrj-99rf
• https://github.com/concourse/concourse/security/advisories/GHSA-5jp2-vwrj-99rf

Get alerted when CVE-2022-31683 or the next vulnerability affects your stack