CVE-2020-5409: pivotal_software concourse Open Redirect
Vulnerability summary
CVE-2020-5409 is a high (CVSS 7.6) Open Redirect vulnerability in pivotal_software concourse. EPSS estimates a 0.91% chance of exploitation in the next 30 days, higher than 59.2% of scored vulnerabilities.
Timeline
- 13-05-2020PublishedVulnerability first disclosed.
- 17-09-2024Last modifiedVulnerability information updated.
Description
Pivotal Concourse, most versions prior to 6.0.0, allows redirects to untrusted websites in its login flow. A remote unauthenticated attacker could convince a user to click on a link using the OAuth redirect link with an untrusted website and gain access to that user's access token in Concourse. (This issue is similar to, but distinct from, CVE-2018-15798.)
CVSS metrics
4 scores · 2 sources · 3 versions- NVDNIST7.6HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H
EPSS trend
Probability
0.91%
Chance of exploitation in the next 30 days
Percentile
59%
Versus all other CVEs
30-day change
0.00 pp
From 0.91% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Pivotal1 product
- concourse≥ unspecified, < 5.2.8 | ≥ unspecified, < 5.5.10 | ≥ unspecified, < 5.8.1 | ≥ unspecified, < 6.0.0
Pivotal_software1 product
- concourse< 5.2.8 | ≥ 5.3.0, < 5.5.10 | ≥ 5.6.0, < 5.8.1
2 vendors · 2 products