Skip to content
OpenAdvisories

Package · Go

github.com/concourse/concourse

5 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 5.4
    CVE-2022-31683

    Team scope authorization bypass when Post/Put request with :team_name in body, allows HTTP parameter pollution

    Concourse (7.x.y prior to 7.8.3 and 6.x.y prior to 6.7.9) contains an authorization bypass issue. A Concourse user can send a request with body including :team_name=team2 to bypass team scope check to gain access to certain resources belong to any other team.

    github.com/concourse/concourse Go
  • Medium 6.8
    CVE-2019-3792

    Concourse 5.0.0 SQL Injection vulnerability

    Pivotal Concourse version 5.0.0, contains an API that is vulnerable to SQL injection. An Concourse resource can craft a version identifier that can carry a SQL injection payload to the Concourse server, allowing the attacker to read privileged data.

    Pivotal Concourse github.com/concourse/concourse Go