Concourse

4 results · Feed

• High 7.6
  CVE-2020-5409

  Concourse Open Redirect in the /sky/login endpoint

  Pivotal Concourse, most versions prior to 6.0.0, allows redirects to untrusted websites in its login flow. A remote unauthenticated attacker could convince a user to click on a link using the OAuth redirect link with an untrusted website and gain access to th…

  Pivotal Concourse
  May 13, 2020
• Medium 6.8
  CVE-2019-3792

  Concourse 5.0.0 SQL Injection vulnerability

  Pivotal Concourse version 5.0.0, contains an API that is vulnerable to SQL injection. An Concourse resource can craft a version identifier that can carry a SQL injection payload to the Concourse server, allowing the attacker to read privileged data.

  Pivotal Concourse github.com/concourse/concourse Go
  Apr 1, 2019
• Medium 4.5
  CVE-2019-3803

  Concourse includes token in CLI authentication callback

  Pivotal Concourse, all versions prior to 4.2.2, puts the user access token in a url during the login flow. A remote attacker who gains access to a user's browser history could obtain the access token and use it to authenticate as the user.

  Pivotal Concourse
  Jan 12, 2019
• High 7.6
  CVE-2018-15798

  Pivotal Concourse allows malicious redirect urls on login

  Pivotal Concourse Release, versions 4.x prior to 4.2.2, login flow allows redirects to untrusted websites. A remote unauthenticated attacker could convince a user to click on a link using the oAuth redirect link with an untrusted website and gain access to th…

  Pivotal Concourse github.com/concourse/concourse Go
  Dec 19, 2018