CVE-2018-15798: Pivotal Software Concourse

Medium severity, CVSS 5.4. EPSS: 1.1% chance of exploitation in the next 30 days.

Pivotal Concourse Release, versions 4.x prior to 4.2.2, login flow allows redirects to untrusted websites. A remote unauthenticated attacker could convince a user to click on a link using the oAuth redirect link with an untrusted website and gain access to that user's access token in Concourse.

Affected products

• Pivotal Software Concourse: from 4.0.0, before 4.2.2 (fixed in 4.2.2)

Published 2018-12-19. Last modified 2026-06-17.