Description
Pivotal Concourse version 5.0.0, contains an API that is vulnerable to SQL injection. An Concourse resource can craft a version identifier that can carry a SQL injection payload to the Concourse server, allowing the attacker to read privileged data.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Pivotal | Concourse | All – < v5.0.1 | v5.0.1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/concourse/concourse | < 5.0.1 | 5.0.1 | GHSA-4fqx-74rv-638w |