Concourse vulnerabilitiesRanked by how likely they are to be used.
Concourse is made by Pivotal Software. We track 7 published vulnerabilities in it, across 222 versions. None of them is on the list of flaws known to be exploited today. If you run Concourse, keep it on a version the vendor still supports.
We keep watching the known-exploited list.
Which Concourse vulnerabilities are being exploited?
This is the list that matters most: flaws criminals are using now.
None of Concourse's published vulnerabilities is on the list of flaws known to be exploited today. We keep watching that list.
Which Concourse flaws are most likely to be used?
Ranked by the latest exploit-likelihood forecast: the chance each flaw is used in an attack in the next 30 days. A high severity score on its own doesn't tell you that. Flaws shared by many other makers' products are left out.
- 1.2%CVE-2020-5415Critical
Concourse, versions prior to 6.3.1 and 6.4.1, in installations which use the GitLab auth connector, is vulnerable to identity spoofing by way of configuring a GitLab account with the same full name as another user...
- 1.2%CVE-2018-1227High
Pivotal Concourse after 2018-03-05 might allow remote attackers to have an unspecified impact, if a customer obtained the Concourse software from a DNS domain that is no longer controlled by Pivotal.
- 1.1%CVE-2018-15798Medium
Pivotal Concourse Release, versions 4.x prior to 4.2.2, login flow allows redirects to untrusted websites.
- 1.1%CVE-2019-3792High
Pivotal Concourse version 5.0.0, contains an API that is vulnerable to SQL injection.
- 0.9%CVE-2020-5409Medium
Pivotal Concourse, most versions prior to 6.0.0, allows redirects to untrusted websites in its login flow.
- 0.6%CVE-2019-3803High
Pivotal Concourse, all versions prior to 4.2.2, puts the user access token in a url during the login flow.
- 0.5%CVE-2022-31683Medium
Concourse (7.x.y prior to 7.8.3 and 6.x.y prior to 6.7.9) contains an authorization bypass issue.
Running Concourse? We'll keep checking.
Looking flaws up one at a time doesn't scale. Tell us what you run once, and we tell you which flaws matter to you, in what order, and keep watching for new ones.
- Tell us what you runPick your software from a list, or let us work it out from your website.
- We match it to every flawOver 400,000 published flaws, checked against your list.
- Ranked by real-world riskA 0 to 100 score, led by evidence criminals are using it.
- Told as soon as we knowAn alert by email, in the app or by webhook to your own tools.
Free plan, no card needed. Nothing to install.
1 new flaw affects software Acme tracks
Concourse, versions prior to 6.3.1 and 6.4.1, in installations which use the GitLab auth connector, is vulnerable to identity spoofing by way of configuring a GitLab account with the same full name as another user who is granted access to a Concourse team. GitLab groups do not have this vulnerability, so GitLab users may be moved into groups which are then configured in the Concourse team.
- Matched to
- Concourse on Acme's software list
- What to do
- Plan in the vendor’s update
Sent to the alert recipients Acme chose. Also in the app and to Acme's webhook.
We track 7 published vulnerabilities listed under the name Concourse, across 222 versions.
None of Concourse's vulnerabilities is on the list of flaws known to be exploited today.
Create a Precursor Intelligence account and track Concourse. We match it against every published flaw, give each one a risk score from 0 to 100 and keep watching, so you hear about new ones as soon as we know, by email, in the app or by webhook.