« Volver al listado

CVE-2017-18111

Estado: ModificadaAlta (8.7)—

The OAuthHelper in Atlassian Application Links before version 5.0.10, from version 5.1.0 before version 5.1.3, and from version 5.2.0 before version 5.2.6 used an XML document builder that was vulnerable to XXE when consuming a client OAuth request. This allowed malicious oauth application linked applications to probe internal network resources by requesting internal locations, read the contents of files and also cause an out of memory exception affecting availability via an XML External Entity vulnerability.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Atlassian — Application Links

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2017-18111",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:P",
          "authentication": "SINGLE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 4.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.0",
          "baseScore": 8.7,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.8,
        "exploitabilityScore": 2.3
      }
    ]
  },
  "affected": [
    {
      "source": "security@atlassian.com",
      "affectedData": [
        {
          "vendor": "Atlassian",
          "product": "Application Links",
          "versions": [
            {
              "status": "affected",
              "version": "unspecified",
              "lessThan": "5.0.10",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "5.1.0",
              "lessThan": "unspecified",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "unspecified",
              "lessThan": "5.1.3",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "5.2.0",
              "lessThan": "unspecified",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "unspecified",
              "lessThan": "5.2.6",
              "versionType": "custom"
            }
          ]
        }
      ]
    }
  ],
  "published": "2019-03-29T14:29:00.483",
  "references": [
    {
      "url": "https://ecosystem.atlassian.net/browse/APL-1338",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@atlassian.com"
    },
    {
      "url": "https://ecosystem.atlassian.net/browse/APL-1338",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-611"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The OAuthHelper in Atlassian Application Links before version 5.0.10, from version 5.1.0 before version 5.1.3, and from version 5.2.0 before version 5.2.6 used an XML document builder that was vulnerable to XXE when consuming a client OAuth request. This allowed malicious oauth application linked applications to probe internal network resources by requesting internal locations, read the contents of files and also cause an out of memory exception affecting availability via an XML External Entity vulnerability."
    },
    {
      "lang": "es",
      "value": "OAuthHelper en Atlassian Application Links, en versiones anteriores a la 5.0.10, desde la 5.1.0 hasta la 5.1.3 y desde la 5.2.0 hasta la 5.2.6, utilizaba un constructor de documentos XML que era vulnerable a XEE (XML External Entity) al consumir una petición OAuth del cliente. Esto permitía a las aplicaciones enlazadas a aplicaciones oauth maliciosas sondear recursos de red internos, solicitando ubicaciones internas, leyendo los contenidos de los archivos y causando una excepción de fuera de memoria mediante una vulnerabilidad de XEE (XML External Entity)."
    }
  ],
  "lastModified": "2026-06-17T01:12:13.320",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:atlassian:application_links:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "39C7E940-29B1-4A70-82F2-9EBA6A5E75EF",
              "versionEndExcluding": "5.0.10"
            },
            {
              "criteria": "cpe:2.3:a:atlassian:application_links:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8F67A8D7-CB6A-438A-822D-244A84DD4887",
              "versionEndExcluding": "5.1.3",
              "versionStartIncluding": "5.1.0"
            },
            {
              "criteria": "cpe:2.3:a:atlassian:application_links:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EAF55B98-3B2F-44CD-9613-5B5E22786547",
              "versionEndExcluding": "5.2.6",
              "versionStartIncluding": "5.2.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@atlassian.com"
}