PT-2019-16722 · Pivotal · Pivotal Concourse

Published 2019-04-01 · Updated 2022-02-15 · CVE-2019-3792

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Pivotal Concourse version 5.0.0

Description The issue concerns an API in Pivotal Concourse that is susceptible to SQL injection attacks. Specifically, an attacker can craft a version identifier with a SQL injection payload, which can be sent to the Concourse server. This allows the attacker to access privileged data.

Recommendations For Pivotal Concourse version 5.0.0, consider disabling access to the vulnerable API endpoint until a patch is available. Restrict the ability of Concourse resources to craft version identifiers that could contain malicious SQL injection payloads to minimize the risk of exploitation.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2019-3792

GHSA-4FQX-74RV-638W

Affected Products

Pivotal Concourse

References · 7

• https://osv.dev/vulnerability/GHSA-4fqx-74rv-638w · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-3792 · Vendor Advisory
• https://pivotal.io/security/cve-2019-3792 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-3792 · Security Note
• https://github.com/concourse/concourse/commit/dc3d15ab6c3a69890c9985f9c875d4c2949be727 · Note
• https://github.com/concourse/concourse/blob/master/release-notes/v5.0.1.md#v501-note-1 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3792 · Note