Read the docs

Spring by Pivotal

Records146All Threatist records
Exploited (KEV)1In CISA KEV
CVSS critical30CVSS 9.0–10.0
CVSS high64CVSS 7.0–8.9

Exploited now

Spring by Pivotal records in CISA KEV
TI-2018-01178 VMware Tanzu Spring Data Commons Property Binder Vulnerability Priority CRITICAL 100KEV 2022-03-25

Components

Products in the NVD configurations · select one to filter the records
Cloud Foundry Uaa 32 records MEDIUM Cloud Foundry Elastic Runtime 28 records MEDIUM Rabbitmq 11 records MEDIUM Cloud Foundry 10 records MEDIUM Operations Manager 10 records MEDIUM Spring Framework 10 records HIGH Cloud Foundry Uaa-release 8 records MEDIUM Concourse 7 records MEDIUM

Records

7 records in Concourse · all components

TI-2022-13602 CVE-2022-31683 · GHSA-5jp2-vwrj-99rf

Authorization bypass in Concourse

Priority MEDIUM 58

Concourse (7.x.y prior to 7.8.3 and 6.x.y prior to 6.7.9) contains an authorization bypass issue.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00467 Published 2022-12-19 Fixed in 6.7.9, 7.8.3 CWE-639
TI-2020-04461 CVE-2020-5415 · GHSA-627p-rr78-99rj

Concourse's GitLab auth allows impersonation

Priority MEDIUM 45

Concourse, versions prior to 6.3.1 and 6.4.1, in installations which use the GitLab auth connector, is vulnerable to identity spoofing by way of configuring a GitLab account with the same full name as another user who is…

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.01217 Published 2020-08-12 Fixed in 6.4.1, 6.3.1 +3 CWE-290
TI-2018-11262 CVE-2018-15798 · GHSA-9689-rx4v-cqgc

Pivotal Concourse allows malicious redirect urls on login

Priority LOW 36

Pivotal Concourse Release, versions 4.x prior to 4.2.2, login flow allows redirects to untrusted websites.

CVSS 3.0HIGH 7.6 Network No auth User interaction EPSS 0.01145 Published 2018-12-19 Fixed in 4.2.2, 5.2.8 +2 CWE-601
TI-2019-02805 CVE-2019-3792 · GHSA-4fqx-74rv-638w

Concourse 5.0.0 SQL Injection vulnerability

Priority LOW 35

Pivotal Concourse version 5.0.0, contains an API that is vulnerable to SQL injection.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.01091 Published 2019-04-01 Fixed in v5.0.1, 5.0.1 CWE-89
TI-2019-02815 CVE-2019-3803 · GHSA-9xg8-22rr-c6vh

Concourse includes token in CLI authentication callback

Priority LOW 34

Pivotal Concourse, all versions prior to 4.2.2, puts the user access token in a url during the login flow.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.00642 Published 2019-01-12 Fixed in 4.2.2 CWE-200
TI-2020-04455 CVE-2020-5409

Concourse Open Redirect in the /sky/login endpoint

Priority LOW 29

Pivotal Concourse, most versions prior to 6.0.0, allows redirects to untrusted websites in its login flow.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00907 Published 2020-05-13 Fixed in 5.2.8, 5.5.10 +2 CWE-601
Open these records in search →