Vulnerability Description
The OAuth status rest resource in Atlassian Application Links before version 5.2.7, from 5.3.0 before 5.3.4 and from 5.4.0 before 5.4.3 allows remote attackers with administrative rights to access the content of internal network resources via a Server Side Request Forgery (SSRF) by creating an OAuth application link to a location they control and then redirecting access from the linked location's OAuth status rest resource to an internal location. When running in an environment like Amazon EC2, this flaw maybe used to access to a metadata resource that provides access credentials and other potentially confidential information.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Atlassian | Application Links | < 5.2.7 |
Related Weaknesses (CWE)
References
- https://ecosystem.atlassian.net/browse/APL-1359Vendor Advisory
- https://ecosystem.atlassian.net/browse/APL-1359Vendor Advisory
FAQ
What is CVE-2017-18096?
CVE-2017-18096 is a vulnerability with a CVSS score of 7.2 (HIGH). The OAuth status rest resource in Atlassian Application Links before version 5.2.7, from 5.3.0 before 5.3.4 and from 5.4.0 before 5.4.3 allows remote attackers with administrative rights to access the...
How severe is CVE-2017-18096?
CVE-2017-18096 has been rated HIGH with a CVSS base score of 7.2/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2017-18096?
Check the references section above for vendor advisories and patch information. Affected products include: Atlassian Application Links.