GitHub Advisoryadvisory · Go

GHSA-4fqx-74rv-638w Pivotal Concourse SQL Injection Vulnerability

HIGH Published 2022-02-15 Modified 2023-09-15 Official page ↗
Aliases
CVE-2019-3792
Ecosystem
Go
Packages
github.com/concourse/concourse
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-89
Reviewed
2021-05-12

Affected packages

• Go github.com/concourse/concourse: < 5.0.1 → fixed in 5.0.1

Description

Pivotal Concourse version 5.0.0, contains an API that is vulnerable to SQL injection. An Concourse resource can craft a version identifier that can carry a SQL injection payload to the Concourse server, allowing the attacker to read privileged data.

Related

Alias · CVE (1)

  • CVE-2019-3792 Pivotal Concourse version 5.0.0, contains an API that is vulnerable to SQL injection. vulnerability

Weakness · CWE (1)

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References