Pivotal Concourse vulnerabilities

4 vulnerabilities

Known vulnerabilities in Pivotal Concourse, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

7.6CVE-2018-15798github.com/concourseconcourse+2
EPSS score
1.15%
Pivotal Concourse Release, versions 4.x prior to 4.2.2, login flow allows redirects to untrusted websites. A remote unauthenticated attacker could convince a user to click on a link using the oAuth redirect link with an untrusted website and gain access to that user's access token in Concourse.7.6CVE-2020-5409pivotal_softwareconcourse+1
EPSS score
0.91%
Pivotal Concourse, most versions prior to 6.0.0, allows redirects to untrusted websites in its login flow. A remote unauthenticated attacker could convince a user to click on a link using the OAuth redirect link with an untrusted website and gain access to that user's access token in Concourse. (This issue is similar to, but distinct from, CVE-2018-15798.)7.5CVE-2019-3792github.com/concourseconcourse+2
EPSS score
1.09%
Pivotal Concourse version 5.0.0, contains an API that is vulnerable to SQL injection. An Concourse resource can craft a version identifier that can carry a SQL injection payload to the Concourse server, allowing the attacker to read privileged data.7.5CVE-2019-3803pivotal_softwareconcourse+1
EPSS score
0.64%
Pivotal Concourse, all versions prior to 4.2.2, puts the user access token in a url during the login flow. A remote attacker who gains access to a user's browser history could obtain the access token and use it to authenticate as the user.