CyberSec.Space Logo
Back to CVE Browser

CVE-2020-5409

MEDIUM
6.1
CVSS Severity Score
EPSS Score0.0130%
EPSS Percentile6.66th
PublishedMay 14, 2020
Last ModifiedNov 21, 2024

Vulnerability Description

Pivotal Concourse, most versions prior to 6.0.0, allows redirects to untrusted websites in its login flow. A remote unauthenticated attacker could convince a user to click on a link using the OAuth redirect link with an untrusted website and gain access to that user's access token in Concourse. (This issue is similar to, but distinct from, CVE-2018-15798.)

Affected Platforms (CPE)

📦
Pivotal Software

Concourse

< 5.2.8
📦
Pivotal Software

Concourse

>= 5.3.0 and < 5.5.10
📦
Pivotal Software

Concourse

>= 5.6.0 and < 5.8.1

References & Advisories

🔗 https://tanzu.vmware.com/security/cve-2020-5409
🔗 https://tanzu.vmware.com/security/cve-2020-5409

Related Vulnerabilities

CVE-2020-541510.0

Concourse, versions prior to 6.3.1 and 6.4.1, in installations which use the GitLab auth connector, is vulnerable to identity spoo...

CVE-2018-157987.6

Pivotal Concourse Release, versions 4.x prior to 4.2.2, login flow allows redirects to untrusted websites. A remote unauthenticate...

CVE-2018-12277.5

Pivotal Concourse after 2018-03-05 might allow remote attackers to have an unspecified impact, if a customer obtained the Concours...

CVE-2019-37926.8

Pivotal Concourse version 5.0.0, contains an API that is vulnerable to SQL injection. An Concourse resource can craft a version id...