{"id":"CVE-2017-16860","url":"https://www.cyber-defence.io/tools/cve/CVE-2017-16860","generatedAt":"2026-10-29T02:03:55.475Z","title":"The invalidRedirectUrl template in Atlassian Application Links before version 5.2.7, from version 5.3.0 before version 5.3.4 and from version 5.4.0 before version 5.4.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site…","description":"The invalidRedirectUrl template in Atlassian Application Links before version 5.2.7, from version 5.3.0 before version 5.3.4 and from version 5.4.0 before version 5.4.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the redirectUrl parameter link in the redirect warning message.","published":"2018-05-14T13:29:00.000Z","lastModified":"2026-06-17T01:10:02.000Z","status":"Modified","sourceIdentifier":"security@atlassian.com","cvss":{"version":"3.0","score":6.1,"severity":"MEDIUM","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},"cwe":["CWE-79"],"affected":["atlassian/application links"],"epss":{"score":0.00872,"percentile":0.5869,"date":"2026-10-27","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.87%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"http://www.securityfocus.com/bid/104188","tags":["Third Party Advisory","VDB Entry"],"source":"security@atlassian.com"},{"url":"https://ecosystem.atlassian.net/browse/APL-1363","tags":["Third Party Advisory"],"source":"security@atlassian.com"},{"url":"http://www.securityfocus.com/bid/104188","tags":["Third Party Advisory","VDB Entry"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://ecosystem.atlassian.net/browse/APL-1363","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2017-16860","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}