Concourse vulnerabilitiesRanked by how likely they are to be used.
Concourse is made by Pivotal Software. We track 7 published vulnerabilities in it, across 222 versions. None of them is on the list of flaws known to be exploited today. If you run Concourse, keep it on a version the vendor still supports.
We keep watching the known-exploited list.
Which Concourse vulnerabilities are being exploited?
This is the list that matters most: flaws criminals are using now.
None of Concourse's published vulnerabilities is on the list of flaws known to be exploited today. We keep watching that list.
Which Concourse flaws are most likely to be used?
Ranked by the latest exploit-likelihood forecast: the chance each flaw is used in an attack in the next 30 days. A high severity score on its own doesn't tell you that. Flaws shared by many other makers' products are left out.
- 1.2%CVE-2018-1227High
Pivotal Concourse after 2018-03-05 might allow remote attackers to have an unspecified impact, if a customer obtained the Concourse software from a DNS domain that is no longer controlled by Pivotal.
- 1.2%CVE-2020-5415Critical
Concourse, versions prior to 6.3.1 and 6.4.1, in installations which use the GitLab auth connector, is vulnerable to identity spoofing by way of configuring a GitLab account with the same full name as another user...
- 1.1%CVE-2018-15798Medium
Pivotal Concourse Release, versions 4.x prior to 4.2.2, login flow allows redirects to untrusted websites.
- 1.1%CVE-2019-3792High
Pivotal Concourse version 5.0.0, contains an API that is vulnerable to SQL injection.
- 0.9%CVE-2020-5409Medium
Pivotal Concourse, most versions prior to 6.0.0, allows redirects to untrusted websites in its login flow.
- 0.6%CVE-2019-3803High
Pivotal Concourse, all versions prior to 4.2.2, puts the user access token in a url during the login flow.
- 0.4%CVE-2022-31683Medium
Concourse (7.x.y prior to 7.8.3 and 6.x.y prior to 6.7.9) contains an authorization bypass issue.
Running Concourse? We'll keep checking.
Looking flaws up one at a time doesn't scale. Tell us what you run once, and we tell you which flaws matter to you, in what order, and keep watching for new ones.
- Tell us what you runPick your software from a list, or let us work it out from your website.
- We match it to every flawOver 400,000 published flaws, checked against your list.
- Ranked by real-world riskA 0 to 100 score, led by evidence criminals are using it.
- Told as soon as we knowAn alert by email, in the app or by webhook to your own tools.
Free plan, no card needed. Nothing to install.
1 new flaw affects software Acme tracks
Pivotal Concourse after 2018-03-05 might allow remote attackers to have an unspecified impact, if a customer obtained the Concourse software from a DNS domain that is no longer controlled by Pivotal. The original domain for the Concourse CI (concourse-dot-ci) open source project has been registered by an unknown actor, and is therefore no longer the official website for Concourse CI. The new official domain is concourse-ci.org. At approximately 4 am EDT on March 7, 2018 the Concourse OSS team began receiving reports that the Concourse domain was not responding. The Concourse OSS team discovered, upon investigation with both the original and the new domain registrars, that the originating domain registrar had made the domain available for purchase. This was done despite the domain being renewed by the Concourse OSS team through August 2018. For a customer to be affected, they would have needed to access a download from a "concourse-dot-ci" domain web site after March 6, 2018 18:00:00 EST. Accessing that domain is NOT recommended by Pivotal. Anyone who had been using that domain should immediately begin using the concourse-ci.org domain instead. Customers can also safely access Concourse software from the traditionally available locations on the Pivotal Network or GitHub.
- Matched to
- Concourse on Acme's software list
- What to do
- Plan in the vendor’s update
Sent to the alert recipients Acme chose. Also in the app and to Acme's webhook.
We track 7 published vulnerabilities listed under the name Concourse, across 222 versions.
None of Concourse's vulnerabilities is on the list of flaws known to be exploited today.
Create a EdgeProtect account and track Concourse. We match it against every published flaw, give each one a risk score from 0 to 100 and keep watching, so you hear about new ones as soon as we know, by email, in the app or by webhook.