Open Redirect Affecting github.com/concourse/concourse/skymarshal/skyserver package, versions =6.0.0 >=5.2.0 <5.2.8 =5.3.0 =5.3.0-rc.9 =5.3.0-rc.8 >=5.4.0 <5.4.0 >=5.5.0 <5.5.10 =5.6.0 >=5.7.0 <5.7.2 >=5.8.0 <5.8.1
Snyk CVSS
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-GOLANG-GITHUBCOMCONCOURSECONCOURSESKYMARSHALSKYSERVER-569085
- published 14 May 2020
- disclosed 14 May 2020
- credit Michele Romano
Introduced: 14 May 2020
CVE-2020-5409 Open this link in a new tabHow to fix?
Upgrade github.com/concourse/concourse/skymarshal/skyserver to version 5.2.8, 5.5.10, 5.7.2, 5.8.1 or higher.
Overview
github.com/concourse/concourse/skymarshal/skyserver is a module of Concourse CI/CD automation system.
Affected versions of this package are vulnerable to Open Redirect. It allows redirects to untrusted websites in its login flow. A remote unauthenticated attacker could convince a user to click on a link using the OAuth redirect link with an untrusted website and gain access to that user's access token in Concourse. (This issue is similar to, but distinct from, CVE-2018-15798.)