Skip to content
OpenAdvisories

Product · Pivotal

Concourse

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 6.8
    CVE-2019-3792

    Concourse 5.0.0 SQL Injection vulnerability

    Pivotal Concourse version 5.0.0, contains an API that is vulnerable to SQL injection. An Concourse resource can craft a version identifier that can carry a SQL injection payload to the Concourse server, allowing the attacker to read privileged data.

    Pivotal Concourse github.com/concourse/concourse Go
  • Medium 4.5
    CVE-2019-3803

    Concourse includes token in CLI authentication callback

    Pivotal Concourse, all versions prior to 4.2.2, puts the user access token in a url during the login flow. A remote attacker who gains access to a user's browser history could obtain the access token and use it to authenticate as the user.

    Pivotal Concourse