VulnerabilityModified

CVE-2017-9506

The IconUriServlet of the Atlassian OAuth Plugin from version 1.3.0 before version 1.9.12 and from version 2.0.0 before version 2.0.4 allows remote attackers to access the content of internal network resources and/or perform an XSS attack via Server…

MEDIUM 6.1EPSS 71.6%

Does this matter?

EPSS puts the probability of exploitation in the next 30 days at 71.6%, higher than 99% of all known CVEs. Patch or mitigate before the next change window.

Description

CVSS 3.0: 6.1 MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS: 71.60% probability · 99th percentile
CISA KEV: Not listed
Weakness: CWE-918
Affected: atlassian/oauth
Source: security@atlassian.com

References

http://dontpanic.42.nl/2017/12/there-is-proxy-in-your-atlassian.htmlExploit, Third Party Advisory
https://ecosystem.atlassian.net/browse/OAUTH-344Issue Tracking, Vendor Advisory
https://medium.com/bugbountywriteup/piercing-the-veil-server-side-request-forgery-to-niprnet-access-171018bca2c3Broken Link, Third Party Advisory
https://twitter.com/Zer0Security/status/983529439433777152Exploit, Third Party Advisory
https://twitter.com/ankit_anubhav/status/973566620676382721Exploit, Third Party Advisory
http://dontpanic.42.nl/2017/12/there-is-proxy-in-your-atlassian.htmlExploit, Third Party Advisory
https://ecosystem.atlassian.net/browse/OAUTH-344Issue Tracking, Vendor Advisory
https://medium.com/bugbountywriteup/piercing-the-veil-server-side-request-forgery-to-niprnet-access-171018bca2c3Broken Link, Third Party Advisory
https://twitter.com/Zer0Security/status/983529439433777152Exploit, Third Party Advisory
https://twitter.com/ankit_anubhav/status/973566620676382721Exploit, Third Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.