CVE-2019-3803: Concourse includes token in CLI authentication callback
Published Jan 10, 2019
·Updated
Pivotal Concourse, all versions prior to 4.2.2, puts the user access token in a url during the login flow. A remote attacker who gains access to a user's browser history could obtain the access token and use it to authenticate as the user.
Affected Software
1 affected component
Pivotal Software Concourse<4.2.2
Event History
Jan 12, 2019
CVE Published
12:29 AM
Data Sourced
via NVD·12:29 AM
DescriptionSeverityWeaknessAffected Software
CVE Published
via MITRE·01:00 AM
Data Sourced
via MITRE·01:00 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is CVE-2019-3803?
CVE-2019-3803 is a vulnerability in Pivotal Concourse versions prior to 4.2.2 that allows a remote attacker to obtain a user's access token from the browser history.
2
How does CVE-2019-3803 affect Pivotal Concourse?
CVE-2019-3803 affects Pivotal Concourse versions prior to 4.2.2.
3
What is the severity of CVE-2019-3803?
CVE-2019-3803 is considered high severity with a severity value of 7.5.
4
How can a remote attacker exploit CVE-2019-3803?
A remote attacker can gain access to a user's browser history to obtain the access token and authenticate as the user.
5
Is there a fix available for CVE-2019-3803?
Yes, the fix for CVE-2019-3803 is to update Pivotal Concourse to version 4.2.2 or later.