CVE-2017-16860

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The invalidRedirectUrl template in Atlassian Application Links before version 5.2.7, from version 5.3.0 before version 5.3.4 and from version 5.4.0 before version 5.4.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the redirectUrl parameter link in the redirect warning message.

Metrics

CVSS 3.0 6.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Atlassian	Application Links	>= unspecified, < 5.2.7; >= 5.3.0, < unspecified; >= unspecified, < 5.3.4; >= 5.4.0, < unspecified; >= unspecified, < 5.4.3

References

http://www.securityfocus.com/bid/104188Third Party Advisory, VDB Entry
https://ecosystem.atlassian.net/browse/APL-1363Third Party Advisory
http://www.securityfocus.com/bid/104188Third Party Advisory, VDB Entry
https://ecosystem.atlassian.net/browse/APL-1363Third Party Advisory

Timeline

Published: May 14, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-168619.8It was possible for double OGNL evaluation in certain redirect action and in WebWork URL and Anchor tags in JSP files to occur. An attacker CVE-2017-168624.3The IncomingMailServers resource in Atlassian Jira before version 7.6.2 allows remote attackers to modify the "incoming mail" whitelist sett CVE-2017-168636.1The PieChart gadget in Atlassian Jira before version 7.5.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site s CVE-2017-168646.1The issue search resource in Atlassian Jira before version 7.4.2 allows remote attackers to inject arbitrary HTML or JavaScript via a cross CVE-2017-168655.3The Trello importer in Atlassian Jira before version 7.6.1 allows remote attackers to access the content of internal network resources via a CVE-2017-168666.1dayrui FineCms 5.2.0 before 2017.11.16 has Cross Site Scripting (XSS) in core/M_Controller.php via the DR_URI field.CVE-2017-168676.5Amazon Key through 2017-11-16 mishandles Cloud Cam 802.11 deauthentication frames during the delivery process, which makes it easier for (1)CVE-2017-168685.5In SWFTools 0.9.2, the wav_convert2mono function in lib/wav.c does not properly restrict a multiplication within a malloc call, which allows CVE-2017-168697.8p_mach.cpp in UPX 3.94 allows remote attackers to cause a denial of service (invalid memory access and application crash) or possibly have u CVE-2017-168708.1The UpdraftPlus plugin through 1.13.12 for WordPress has SSRF in the updraft_ajax_handler function in /wp-content/plugins/updraftplus/admin.CVE-2017-168718.1The UpdraftPlus plugin through 1.13.12 for WordPress allows remote PHP code execution because the plupload_action function in /wp-content/pl CVE-2017-168729.8An issue was discovered in Teluu pjproject (pjlib and pjlib-util) in PJSIP before 2.7.1. Parsing the numeric header fields in a SIP message