high7.6
CVE-2018-15798
Pivotal Concourse Release, versions 4.x prior to 4.2.2, login flow allows redirects to untrusted websites.
Impact
Pivotal Concourse Release, versions 4.x prior to 4.2.2, login flow allows redirects to untrusted websites. A remote unauthenticated attacker could convince a user to click on a link using the oAuth redirect link with an untrusted website and gain access to that user's access token in Concourse.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Pivotal Software | Concourse | from 4.0.0 before 4.2.2 |