CVE-2018-15798 — Pivotal Concourse allows malicious redirect urls on login
Pivotal Concourse Release, versions 4.x prior to 4.2.2, login flow allows redirects to untrusted websites. A remote unauthenticated attacker could convince a user to click on a …
Published: 2018-12-19 · CVSS: 7.6 · CVSS 3.0
Pivotal Concourse Release, versions 4.x prior to 4.2.2, login flow allows redirects to untrusted websites. A remote unauthenticated attacker could convince a user to click on a link using the oAuth redirect link with an untrusted website and gain access to that user's access token in Concourse.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7