IBM Concert versions 1.0.0 through 3.0.0 contain a vulnerability that allows local attackers to access sensitive information through improper handling of build context directories.

This vulnerability is classified as CWE-552, where build context directories are recursively copied into container images, potentially exposing sensitive files to local users. The attack vector is local, requiring no authentication, and exploits the way the system processes build contexts during container creation.

The exposure of sensitive information within container images can lead to the compromise of proprietary source code, credentials, or internal configuration data. Given the CVSS score of 6.2, this vulnerability represents a significant risk to organizational confidentiality. Unauthorized access to such data may result in broader system exploitation or regulatory compliance failures.

Immediate Action: Upgrade to IBM Concert Software version 3.0.1.1 immediately to resolve the recursive copy flaw.

Proactive Monitoring: Audit container image contents for unauthorized files and review access logs for suspicious local activity during deployment cycles.

Compensating Controls: Implement strict file system permissions on build servers and ensure that build context directories are sanitized prior to container image construction.

Public Exploit Available: Unknown

Organizations utilizing IBM Concert must prioritize the transition to version 3.0.1.1 to eliminate the risk of sensitive data leakage. While the vulnerability requires local access, the potential for exposure of critical build artifacts necessitates prompt remediation to maintain a secure software supply chain.