CVE-2017-9506 | BDVDB-2026-89454 Detail
AtlassianAtlassian OAuth Plugin
Description#
The IconUriServlet of the Atlassian OAuth Plugin from version 1.3.0 before version 1.9.12 and from version 2.0.0 before version 2.0.4 allows remote attackers to access the content of internal network resources and/or perform an XSS attack via Server Side Request Forgery (SSRF).
Impact#
No impact statement in the source data.
Weaknesses#
No weakness recorded in the source data.
References#
- http://dontpanic.42.nl/2017/12/there-is-proxy-in-your-atlassian.html
- https://twitter.com/ankit_anubhav/status/973566620676382721
- https://ecosystem.atlassian.net/browse/OAUTH-344
- https://twitter.com/Zer0Security/status/983529439433777152
- https://medium.com/bugbountywriteup/piercing-the-veil-server-side-request-forgery-to-niprnet-access-171018bca2c3
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.