Pivotal Concourse Release, versions 4.x prior to 4.2.2, login flow allows redirects to untrusted websites. A remote unauthenticated attacker could convince a user to click on a link using the oAuth redirect link with an untrusted website and gain access to that user's access token in Concourse.
References
History

No history.

cve-icon MITRE

Status: PUBLISHED

Assigner: dell

Published: 2018-12-19T22:00:00Z

Updated: 2024-09-17T03:18:08.124Z

Reserved: 2018-08-23T00:00:00

Link: CVE-2018-15798

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2018-12-19T22:29:00.547

Modified: 2024-11-21T03:51:28.330

Link: CVE-2018-15798

cve-icon Redhat

No data.