CVE-2017-9506

medium

Description

The IconUriServlet of the Atlassian OAuth Plugin from version 1.3.0 before version 1.9.12 and from version 2.0.0 before version 2.0.4 allows remote attackers to access the content of internal network resources and/or perform an XSS attack via Server Side Request Forgery (SSRF).

References

https://github.com/pwnosec/jira-vuln-scanner

https://github.com/Pr0t0c01/CVEs

https://github.com/imhunterand/JiraCVE

https://github.com/pwn1sher/jira-ssrf

https://github.com/random-robbie/Jira-Scan

https://twitter.com/ankit_anubhav/status/973566620676382721

https://twitter.com/Zer0Security/status/983529439433777152

https://medium.com/bugbountywriteup/piercing-the-veil-server-side-request-forgery-to-niprnet-access-171018bca2c3

https://ecosystem.atlassian.net/browse/OAUTH-344

http://dontpanic.42.nl/2017/12/there-is-proxy-in-your-atlassian.html

Details

Source: Mitre, NVD

Published: 2017-08-23

Updated: 2026-06-17

Risk Information

CVSS v2

Base Score: 4.3

Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N

Severity: Medium

CVSS v3

Base Score: 6.1

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Severity: Medium

EPSS

EPSS: 0.71601