CVE-2019-3803 — Concourse includes token in CLI authentication callback

CVE-2019-3803

Concourse includes token in CLI authentication callback PUBLISHED

Description (CNA)

Pivotal Concourse, all versions prior to 4.2.2, puts the user access token in a url during the login flow. A remote attacker who gains access to a user's browser history could obtain the access token and use it to authenticate as the user.

Affected (CNA)

Vendor / product	Versions
Pivotal / Concourse	affected all versions before 4.2.2

CWE

CWE-200

References

https://pivotal.io/security/cve-2019-3803

ADP enrichment

CVE

No English description supplied.

https://pivotal.io/security/cve-2019-3803