Code injection

2020-05-1400:15:00

PRIOn knowledge base

www.prio-n.com

5.6 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

49.7%

JSON

Pivotal Concourse, most versions prior to 6.0.0, allows redirects to untrusted websites in its login flow. A remote unauthenticated attacker could convince a user to click on a link using the OAuth redirect link with an untrusted website and gain access to that user’s access token in Concourse. (This issue is similar to, but distinct from, CVE-2018-15798.)

CPENameOperatorVersion
concoursege5.6.0
concourselt5.8.1
concoursege5.3.0
concourselt5.5.10
concourselt5.2.8

Name	Operator	Version
concourse	ge	5.6.0
concourse	lt	5.8.1
concourse	ge	5.3.0
concourse	lt	5.5.10
concourse	lt	5.2.8

References

tanzu.vmware.com/security/cve-2020-5409