CVE-2017-9506

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The IconUriServlet of the Atlassian OAuth Plugin from version 1.3.0 before version 1.9.12 and from version 2.0.0 before version 2.0.4 allows remote attackers to access the content of internal network resources and/or perform an XSS attack via Server Side Request Forgery (SSRF).

Metrics

CVSS 3.0 6.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-918

Affected software

Vendor	Product	Versions
Atlassian	Atlassian OAuth Plugin	From version 1.3.0 before version 1.9.12 and from version 2.0.0 before version 2.0.4.

References

http://dontpanic.42.nl/2017/12/there-is-proxy-in-your-atlassian.htmlExploit, Third Party Advisory
https://ecosystem.atlassian.net/browse/OAUTH-344Issue Tracking, Vendor Advisory
https://medium.com/bugbountywriteup/piercing-the-veil-server-side-request-forgery-to-niprnet-access-171018bca2c3Broken Link, Third Party Advisory
https://twitter.com/Zer0Security/status/983529439433777152Exploit, Third Party Advisory
https://twitter.com/ankit_anubhav/status/973566620676382721Exploit, Third Party Advisory
http://dontpanic.42.nl/2017/12/there-is-proxy-in-your-atlassian.htmlExploit, Third Party Advisory
https://ecosystem.atlassian.net/browse/OAUTH-344Issue Tracking, Vendor Advisory
https://medium.com/bugbountywriteup/piercing-the-veil-server-side-request-forgery-to-niprnet-access-171018bca2c3Broken Link, Third Party Advisory
https://twitter.com/Zer0Security/status/983529439433777152Exploit, Third Party Advisory
https://twitter.com/ankit_anubhav/status/973566620676382721Exploit, Third Party Advisory

Timeline

Published: Aug 23, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-95075.4The review dashboard resource in Atlassian Crucible from version 4.1.0 before version 4.4.1 allows remote attackers to inject arbitrary HTML CVE-2017-95085.4Various resources in Atlassian Fisheye and Crucible before version 4.4.1 allow remote attackers to inject arbitrary HTML or JavaScript via a CVE-2017-95095.4The review file upload resource in Atlassian Crucible before version 4.4.1 allows remote attackers to inject arbitrary HTML or JavaScript vi CVE-2017-95105.4The repository changelog resource in Atlassian Fisheye before version 4.4.1 allows remote attackers to inject arbitrary HTML or JavaScript v CVE-2017-95117.5The MultiPathResource class in Atlassian Fisheye and Crucible, before version 4.4.1 allows anonymous remote attackers to read arbitrary file CVE-2017-95127.5The mostActiveCommitters.do resource in Atlassian Fisheye and Crucible, before version 4.4.1 allows anonymous remote attackers to access sen CVE-2017-95135.4Several rest inline action resources of Atlassian Activity Streams before version 6.3.0 allows remote authenticated attackers to watch any C CVE-2017-95148.8Bamboo before 6.0.5, 6.1.x before 6.1.4, and 6.2.x before 6.2.1 had a REST endpoint that parsed a YAML file and did not sufficiently restric CVE-2017-95165.4Craft CMS before 2.6.2982 allows for a potential XSS attack vector by uploading a malicious SVG file.CVE-2017-95178.8atmail before 7.8.0.2 has CSRF, allowing an attacker to upload and import users via CSV.CVE-2017-95188.8atmail before 7.8.0.2 has CSRF, allowing an attacker to change the SMTP hostname and hijack all emails.CVE-2017-95198.8atmail before 7.8.0.2 has CSRF, allowing an attacker to create a user account.