Pivotal Concourse allows malicious redirect urls on login

Also known as GHSA-9689-rx4v-cqgc

Published 7 y ago 2018-12-19 · modified 4 mo ago 2026-06-17 · JSON

CVSS

7.6

v3.0 · CNA

CISA KEV

not known exploited

EPSS

1.1%

percentile 67%

Public exploits

none known

Pivotal Concourse Release, versions 4.x prior to 4.2.2, login flow allows redirects to untrusted websites. A remote unauthenticated attacker could convince a user to click on a link using the oAuth redirect link with an untrusted website and gain access to that user's access token in Concourse.

Exploit prediction (EPSS)

1.15% probability of exploitation in the next 30 days, higher than 67% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
CNA	3.0	7.6	`CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H`
CNA	3.0	7.6	`CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H`
NVD	3.0	5.4	`CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N`
NVD	2.0	5.8	`AV:N/AC:M/Au:N/C:P/I:P/A:N`
GitHub	3.1	5.4	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N`

Affected packages

Ecosystem	Package	Affected	Fixed in
go	`github.com/concourse/concourse`	<5.2.8 >=5.3.0, <5.5.10 >=5.6.0, <5.8.1	5.2.8 5.5.10 5.8.1

Affected products

Pivotal Concourse

Classification

Weakness

CWE-601 URL Redirection to Untrusted Site

References

pivotal.io /security/cve-2018-15798 · x_refsource_CONFIRM, x_transferred
nvd.nist.gov /vuln/detail/CVE-2018-15798 · advisory
github.com /concourse/concourse/pull/5350/commits/38cb4cc025e5ed28764b4adc363a0bbf41f3c7cb · web
github.com /concourse/concourse/blob/release/5.2.x/release-notes/v5.2.8.md · web

Sources

CVE List: CVE-2018-15798
GitHub Advisory: GHSA-9689-rx4v-cqgc
NVD: CVE-2018-15798

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.

Summary