CVE-2017-18111

Severity Score

8.7

*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

The OAuthHelper in Atlassian Application Links before version 5.0.10, from version 5.1.0 before version 5.1.3, and from version 5.2.0 before version 5.2.6 used an XML document builder that was vulnerable to XXE when consuming a client OAuth request. This allowed malicious oauth application linked applications to probe internal network resources by requesting internal locations, read the contents of files and also cause an out of memory exception affecting availability via an XML External Entity vulnerability.

OAuthHelper en Atlassian Application Links, en versiones anteriores a la 5.0.10, desde la 5.1.0 hasta la 5.1.3 y desde la 5.2.0 hasta la 5.2.6, utilizaba un constructor de documentos XML que era vulnerable a XEE (XML External Entity) al consumir una petición OAuth del cliente. Esto permitía a las aplicaciones enlazadas a aplicaciones oauth maliciosas sondear recursos de red internos, solicitando ubicaciones internas, leyendo los contenidos de los archivos y causando una excepción de fuera de memoria mediante una vulnerabilidad de XEE (XML External Entity).

*Credits: N/A

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

High

Attack Vector

Network

Attack Complexity

Low

Authentication

Single

Confidentiality

Partial

Integrity

None

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2018-02-01 CVE Reserved
2019-03-29 CVE Published
2023-03-07 EPSS Updated
2024-09-16 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-611: Improper Restriction of XML External Entity Reference

CAPEC

References (1)

URL	Tag	Source

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
https://ecosystem.atlassian.net/browse/APL-1338	2019-04-01

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Atlassian Search vendor "Atlassian"		Application Links Search vendor "Atlassian" for product "Application Links"				< 5.0.10 Search vendor "Atlassian" for product "Application Links" and version " < 5.0.10"		-		Affected
Atlassian Search vendor "Atlassian"		Application Links Search vendor "Atlassian" for product "Application Links"				>= 5.1.0 < 5.1.3 Search vendor "Atlassian" for product "Application Links" and version " >= 5.1.0 < 5.1.3"		-		Affected
Atlassian Search vendor "Atlassian"		Application Links Search vendor "Atlassian" for product "Application Links"				>= 5.2.0 < 5.2.6 Search vendor "Atlassian" for product "Application Links" and version " >= 5.2.0 < 5.2.6"		-		Affected