CVE-2019-3803: Pivotal Software Concourse

High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days.

Pivotal Concourse, all versions prior to 4.2.2, puts the user access token in a url during the login flow. A remote attacker who gains access to a user's browser history could obtain the access token and use it to authenticate as the user.

Affected products

• Pivotal Software Concourse: before 4.2.2 (fixed in 4.2.2)

Published 2019-01-12. Last modified 2026-06-17.