CVE-2019-3792: 
Concourse CI vulnerability analysis and mitigation

Pivotal Concourse version 5.0.0 contains an API vulnerability that is susceptible to SQL injection attacks. The vulnerability was assigned CVE-2019-3792 and was later patched in version 5.0.1. This security flaw allows an attacker to craft a version identifier that carries a SQL injection payload to the Concourse server (NVD, CVE).

The vulnerability has been assigned a CVSS v3.0 base score of 7.5 (HIGH) by NVD with vector string CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, while Dell assigned it a score of 6.8 (MEDIUM) with vector string CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:H. The weakness is classified under CWE-89, which refers to Improper Neutralization of Special Elements used in SQL Commands (NVD).

The primary impact of this vulnerability is the potential exposure of privileged data. An attacker can exploit this vulnerability to read sensitive information from the database through crafted SQL injection payloads (NVD).

The vulnerability can be exploited by crafting a version identifier that contains a SQL injection payload. The attack vector is network-accessible (AV:N) and requires no privileges (PR:N) to execute (NVD).

The vulnerability has been fixed in Pivotal Concourse version 5.0.1. Users are advised to upgrade to this version or later to mitigate the risk (NVD).