CVE-2018-15798

MEDIUM5.4EPSS 0.56%

Pivotal Concourse Open Redirect in Login Flow

Published: 2/15/2022Modified: 11/8/2023

Description

Pivotal Concourse Release, versions 4.x prior to 4.2.2, login flow allows redirects to untrusted websites. A remote unauthenticated attacker could convince a user to click on a link using the oAuth redirect link with an untrusted website and gain access to that user's access token in Concourse. ### Specific Go Packages Affected github.com/concourse/concourse/skymarshal/skyserver

Affected packages (1)

Go/github.com/concourse/concoursefrom 0, < 5.2.8

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	MEDIUM5.4	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

References (4)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2018-15798
WEBhttps://github.com/concourse/concourse/blob/release/5.2.x/release-notes/v5.2.8.md
WEBhttps://github.com/concourse/concourse/pull/5350/commits/38cb4cc025e5ed28764b4adc363a0bbf41f3c7cb
WEBhttps://pivotal.io/security/cve-2018-15798