CVE-2020-5409: 
Concourse CI vulnerability analysis and mitigation

Pivotal Concourse, affecting versions prior to 6.0.0, contains a vulnerability in its login flow that allows redirects to untrusted websites. The vulnerability was disclosed on May 13, 2020, and is tracked as CVE-2020-5409. This security flaw affects multiple versions of Concourse, including all versions prior to 5.2.8, all 5.3.x versions, 5.4.x versions, 5.5.x versions prior to 5.5.10, all 5.6.x versions, 5.7.x versions, and 5.8.x versions prior to 5.8.1 (Vendor Advisory).

The vulnerability is classified as an Open Redirect (CWE-601) issue in the /sky/login endpoint. It received a CVSS v3.1 base score of 6.1 (Medium) from NVD with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, indicating network accessibility, low attack complexity, no privileges required, and user interaction required. The vulnerability is similar to but distinct from a previous issue (CVE-2018-15798) (NVD).

If exploited, this vulnerability could allow an attacker to gain access to a user's access token in Concourse. The impact involves potential compromise of user credentials and unauthorized access to the affected system through the manipulation of OAuth redirect links (Vendor Advisory).

The vulnerability can be exploited by a remote unauthenticated attacker who could convince a user to click on a malicious link that uses the OAuth redirect functionality. The attack requires user interaction but does not require any privileges on the target system (NVD).

Users of affected versions should upgrade to the following patched versions: Concourse 5.2.8, 5.5.10, 5.8.1, or 6.0.0. These versions contain fixes for the vulnerability (Vendor Advisory).