CVE-2019-3803 — Concourse includes token in CLI authentication callback
Pivotal Concourse, all versions prior to 4.2.2, puts the user access token in a url during the login flow. A remote attacker who gains access to a user's browser history could o…
Published: 2019-01-12 · CVSS: 4.5 · CVSS 3.0
Pivotal Concourse, all versions prior to 4.2.2, puts the user access token in a url during the login flow. A remote attacker who gains access to a user's browser history could obtain the access token and use it to authenticate as the user.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7