CVE-2018-15798

Pivotal Concourse Release, versions 4.x prior to 4.2.2, login flow allows redirects to untrusted websites. A remote unauthenticated attacker could convince a user to click on a link using the oAuth redirect link with an untrusted website and gain access to that user's access token in Concourse.

Score

CVSS 3.0 7.6 High

Status

Modified - security_alert@emc.com

Published

2018-12-19

Last modified

2024-09-17

Weaknesses

CWE-601

Affected products

• Concourse (Pivotal)
• Concourse (Pivotal Software)

References

• https://pivotal.io/security/cve-2018-15798