| { |
| "schema_version": "1.4.0", |
| "id": "GHSA-9689-rx4v-cqgc", |
| "modified": "2021-05-12T18:15:16Z", |
| "published": "2022-02-15T01:57:18Z", |
| "aliases": [ |
| "CVE-2018-15798" |
| ], |
| "summary": "Open Redirect", |
| "details": "Pivotal Concourse Release, versions 4.x prior to 4.2.2, login flow allows redirects to untrusted websites. A remote unauthenticated attacker could convince a user to click on a link using the oAuth redirect link with an untrusted website and gain access to that user's access token in Concourse.", |
| "affected": [ |
| { |
| "package": { |
| "ecosystem": "Go", |
| "name": "github.com/concourse/concourse/skymarshal/skyserver" |
| }, |
| "ranges": [ |
| { |
| "type": "ECOSYSTEM", |
| "events": [ |
| { |
| "introduced": "0" |
| }, |
| { |
| "fixed": "5.2.8" |
| } |
| ] |
| } |
| ] |
| }, |
| { |
| "package": { |
| "ecosystem": "Go", |
| "name": "github.com/concourse/concourse/skymarshal/skyserver" |
| }, |
| "ranges": [ |
| { |
| "type": "ECOSYSTEM", |
| "events": [ |
| { |
| "introduced": "5.3.0" |
| }, |
| { |
| "fixed": "5.5.10" |
| } |
| ] |
| } |
| ] |
| }, |
| { |
| "package": { |
| "ecosystem": "Go", |
| "name": "github.com/concourse/concourse/skymarshal/skyserver" |
| }, |
| "ranges": [ |
| { |
| "type": "ECOSYSTEM", |
| "events": [ |
| { |
| "introduced": "5.6.0" |
| }, |
| { |
| "fixed": "5.8.1" |
| } |
| ] |
| } |
| ] |
| } |
| ], |
| "severity": [ |
| { |
| "type": "CVSS_V3", |
| "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N" |
| } |
| ], |
| "references": [ |
| { |
| "type": "ADVISORY", |
| "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-15798" |
| }, |
| { |
| "type": "WEB", |
| "url": "https://github.com/concourse/concourse/pull/5350/commits/38cb4cc025e5ed28764b4adc363a0bbf41f3c7cb" |
| }, |
| { |
| "type": "WEB", |
| "url": "https://github.com/concourse/concourse/blob/release/5.2.x/release-notes/v5.2.8.md" |
| }, |
| { |
| "type": "WEB", |
| "url": "https://pivotal.io/security/cve-2018-15798" |
| } |
| ], |
| "database_specific": { |
| "cwe_ids": [ |
| "CWE-601" |
| ], |
| "github_reviewed": true, |
| "github_reviewed_at": "2021-05-12T18:15:16Z", |
| "nvd_published_at": null, |
| "severity": "MODERATE" |
| } |
| } |
