Lucene search
GoogleOSV:GHSA-9689-RX4V-CQGCHistoryFeb 15, 2022 - 1:57 a.m.
Pivotal Concourse Open Redirect in Login Flow
2022-02-1501:57:18
Google
osv.dev
12
pivotal concourse release
open redirect
login flow
version 4.x
untrusted websites
remote attacker
oauth redirect
access token
concourse
go packages affected
skyserver
software
Pivotal Concourse Release, versions 4.x prior to 4.2.2, login flow allows redirects to untrusted websites. A remote unauthenticated attacker could convince a user to click on a link using the oAuth redirect link with an untrusted website and gain access to that user’s access token in Concourse.
Specific Go Packages Affected
Related
cvelist
cvelist
CVE-2018-15798 Pivotal Concourse allows malicious redirect urls on login
2018-12-19 22:00:00
CVE-2020-5409 Concourse Open Redirect in the /sky/login endpoint
2020-05-13 23:15:17
osv
osv
CVE-2018-15798
2018-12-19 22:29:00
CVE-2020-5409
2020-05-14 00:15:11
BIT-concourse-2020-5409
2024-03-06 10:51:15
prion
prion
Design/Logic Flaw
2018-12-19 22:29:00
Code injection
2020-05-14 00:15:00
github
github
Pivotal Concourse Open Redirect in Login Flow
2022-02-15 01:57:18
nvd
nvd
CVE-2018-15798
2018-12-19 22:29:00
CVE-2020-5409
2020-05-14 00:15:11
cve
cve
CVE-2018-15798
2018-12-19 22:29:00
CVE-2020-5409
2020-05-14 00:15:11