CVE-2019-3803CWE-200

Concourse includes token in CLI authentication callback

Medium · published January 12, 2019

CVSS v3.0
4.5
EPSS
1%
Percentile
50.1
In the wild
Unconfirmed
What it is

Pivotal Concourse, all versions prior to 4.2.2, puts the user access token in a url during the login flow. A remote attacker who gains access to a user's browser history could obtain the access token and use it to authenticate as the user.

The record
Technical detail
CVSS v3.0
4.5 · MEDIUM
Vector
CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00642 · 50.1th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2019-01-12T01:00Z
EPSS history
Timeline
  • 12 JAN 01:00Z
    Concourse includes token in CLI authentication callback
    cvelistv5