PT-2019-16722 · Pivotal · Pivotal Concourse

Publicado 2019-04-01 · Atualizado 2022-02-15 · CVE-2019-3792

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Pivotal Concourse version 5.0.0

Description The issue concerns an API in Pivotal Concourse that is susceptible to SQL injection attacks. Specifically, an attacker can craft a version identifier with a SQL injection payload, which can be sent to the Concourse server. This allows the attacker to access privileged data.

Recommendations For Pivotal Concourse version 5.0.0, consider disabling access to the vulnerable API endpoint until a patch is available. Restrict the ability of Concourse resources to craft version identifiers that could contain malicious SQL injection payloads to minimize the risk of exploitation.

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2019-3792

GHSA-4FQX-74RV-638W

Produtos afetados

Pivotal Concourse

Referências · 7

• https://github.com/concourse/concourse/commit/dc3d15ab6c3a69890c9985f9c875d4c2949be727 · Nota
• https://github.com/concourse/concourse/blob/master/release-notes/v5.0.1.md#v501-note-1 · Nota
• https://osv.dev/vulnerability/GHSA-4fqx-74rv-638w · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-3792 · Aviso do Fabricante
• https://pivotal.io/security/cve-2019-3792 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-3792 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3792 · Nota