CVE-2017-9506

The IconUriServlet of the Atlassian OAuth Plugin from version 1.3.0 before version 1.9.12 and from version 2.0.0 before version 2.0.4 allows remote attackers to access the content of internal network resources and/or perform an XSS attack via Server Side Request Forgery (SSRF).

Affected

Atlassian · Atlassian OAuth Plugin

CVSS v3.0 NVD

6.1 MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CVSS v2.0 NVD

4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N

EPSS

71.60% chance of exploitation in the next 30 days, 99th percentile

Nuclei

medium · CWE-918

Published

2017-08-23

Updated

2024-10-16

Proof-of-concept exploits (1)

• labsbots/CVE-2017-95060★ · 2022-04-03

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-9506.yaml

Security advisories

• https://ecosystem.atlassian.net/browse/OAUTH-344
• http://dontpanic.42.nl/2017/12/there-is-proxy-in-your-atlassian.html
• https://medium.com/bugbountywriteup/piercing-the-veil-server-side-request-forgery-to-nipr…
• https://twitter.com/Zer0Security/status/983529439433777152
• https://twitter.com/ankit_anubhav/status/973566620676382721

References

• CVE Record
• NVD entry