Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

7 records

Vendor: Spring by Pivotal Component: Concourse Clear all filters
TI-2022-13602 CVE-2022-31683 · GHSA-5jp2-vwrj-99rf

Authorization bypass in Concourse

Priority MEDIUM 58

Concourse (7.x.y prior to 7.8.3 and 6.x.y prior to 6.7.9) contains an authorization bypass issue.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00467 Published 2022-12-19 Fixed in 6.7.9, 7.8.3 CWE-639
TI-2020-04461 CVE-2020-5415 · GHSA-627p-rr78-99rj

Concourse's GitLab auth allows impersonation

Priority MEDIUM 45

Concourse, versions prior to 6.3.1 and 6.4.1, in installations which use the GitLab auth connector, is vulnerable to identity spoofing by way of configuring a GitLab account with the same full name as another user who is…

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.01217 Published 2020-08-12 Fixed in 6.4.1, 6.3.1 +3 CWE-290
TI-2020-04455 CVE-2020-5409

Concourse Open Redirect in the /sky/login endpoint

Priority LOW 29

Pivotal Concourse, most versions prior to 6.0.0, allows redirects to untrusted websites in its login flow.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00907 Published 2020-05-13 Fixed in 5.2.8, 5.5.10 +2 CWE-601
TI-2019-02805 CVE-2019-3792 · GHSA-4fqx-74rv-638w

Concourse 5.0.0 SQL Injection vulnerability

Priority LOW 35

Pivotal Concourse version 5.0.0, contains an API that is vulnerable to SQL injection.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.01091 Published 2019-04-01 Fixed in v5.0.1, 5.0.1 CWE-89
TI-2019-02815 CVE-2019-3803 · GHSA-9xg8-22rr-c6vh

Concourse includes token in CLI authentication callback

Priority LOW 34

Pivotal Concourse, all versions prior to 4.2.2, puts the user access token in a url during the login flow.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.00642 Published 2019-01-12 Fixed in 4.2.2 CWE-200
TI-2018-11262 CVE-2018-15798 · GHSA-9689-rx4v-cqgc

Pivotal Concourse allows malicious redirect urls on login

Priority LOW 36

Pivotal Concourse Release, versions 4.x prior to 4.2.2, login flow allows redirects to untrusted websites.

CVSS 3.0HIGH 7.6 Network No auth User interaction EPSS 0.01145 Published 2018-12-19 Fixed in 4.2.2, 5.2.8 +2 CWE-601