medium6.8
CVE-2019-3792
Pivotal Concourse version 5.0.0, contains an API that is vulnerable to SQL injection.
Impact
Pivotal Concourse version 5.0.0, contains an API that is vulnerable to SQL injection. An Concourse resource can craft a version identifier that can carry a SQL injection payload to the Concourse server, allowing the attacker to read privileged data.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Pivotal Software | Concourse | before 5.0.1 |