Open Redirect Affecting Open this link in a new tab package, versions =6.0.0 >=5.2.0 <5.2.8 =5.3.0 =5.3.0-rc.9 =5.3.0-rc.8 >=5.4.0 <5.4.0 >=5.5.0 <5.5.10 =5.6.0 >=5.7.0 <5.7.2 >=5.8.0 <5.8.1

  • Attack Complexity


  • User Interaction


  • Scope


  • Confidentiality


Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • snyk-id


  • published

    14 May 2020

  • disclosed

    14 May 2020

  • credit

    Michele Romano

How to fix?

Upgrade to version 5.2.8, 5.5.10, 5.7.2, 5.8.1 or higher.

Overview is a module of Concourse CI/CD automation system.

Affected versions of this package are vulnerable to Open Redirect. It allows redirects to untrusted websites in its login flow. A remote unauthenticated attacker could convince a user to click on a link using the OAuth redirect link with an untrusted website and gain access to that user's access token in Concourse. (This issue is similar to, but distinct from, CVE-2018-15798.)