Open Redirect Affecting github.com/concourse/concourse/skymarshal/skyserver Open this link in a new tab package, versions =6.0.0 >=5.2.0 <5.2.8 =5.3.0 =5.3.0-rc.9 =5.3.0-rc.8 >=5.4.0 <5.4.0 >=5.5.0 <5.5.10 =5.6.0 >=5.7.0 <5.7.2 >=5.8.0 <5.8.1


0.0
high
  • Attack Complexity

    Low

  • User Interaction

    Required

  • Scope

    Changed

  • Confidentiality

    High

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • snyk-id

    SNYK-GOLANG-GITHUBCOMCONCOURSECONCOURSESKYMARSHALSKYSERVER-569085

  • published

    14 May 2020

  • disclosed

    14 May 2020

  • credit

    Michele Romano

How to fix?

Upgrade github.com/concourse/concourse/skymarshal/skyserver to version 5.2.8, 5.5.10, 5.7.2, 5.8.1 or higher.

Overview

github.com/concourse/concourse/skymarshal/skyserver is a module of Concourse CI/CD automation system.

Affected versions of this package are vulnerable to Open Redirect. It allows redirects to untrusted websites in its login flow. A remote unauthenticated attacker could convince a user to click on a link using the OAuth redirect link with an untrusted website and gain access to that user's access token in Concourse. (This issue is similar to, but distinct from, CVE-2018-15798.)