CVE-2019-3803 - Concourse includes token in CLI authentication callback

Back Back to CVE browser

HIGH

Concourse includes token in CLI authentication callback

Published Jan 12, 2019

7.5

HIGH

CVSS 3.0

EPSS 0.64%

Description

Pivotal Concourse, all versions prior to 4.2.2, puts the user access token in a url during the login flow. A remote attacker who gains access to a user's browser history could obtain the access token and use it to authenticate as the user.

Affected products

Vendor Pivotal Product Concourse Default
n/a
- Version
  all versions
  Status
  affected
  Constraints
  <4.2.2

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Pivotal

Concourse

n/a

Version	Status	Constraints
all versions	affected	<4.2.2

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-200

Exposure of Sensitive Information

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-13429
Advisory
https://pivotal.io/security/cve-2019-3803
x_refsource_CONFIRMVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-13429		Advisory
https://pivotal.io/security/cve-2019-3803		x_refsource_CONFIRMVendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner dell

Published Jan 12, 2019

Updated Sep 16, 2024

Reserved Jan 3, 2019

Link CVE-2019-3803

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2019-3803

Red Hat

Severity n/a

Public date n/a

Links CVE-2019-3803

ENISA EUVD

Assigner dell

Published Jan 12, 2019

Updated Sep 16, 2024

Exploited since n/a

Link EUVD-2019-13429

EUVD-2019-13429