Cross-Site Scripting Vulnerability in Atlassian Application Links
CVE-2017-16860

6.1MEDIUM

Key Information:

Vendor

Atlassian
Status
Application Links
Vendor
CVE Published:
14 May 2018

What is CVE-2017-16860?

The Atlassian Application Links product has a vulnerability related to the invalidRedirectUrl template, which allows remote attackers to exploit the redirectUrl parameter in the redirect warning messages. This security flaw enables the injection of arbitrary HTML or JavaScript code, posing a significant risk of cross-site scripting attacks. It primarily affects versions of the software prior to 5.2.7, as well as versions 5.3.0 up to 5.3.4 and 5.4.0 to 5.4.3. Users are advised to update to the latest version to mitigate these risks.

Affected Version(s)

Application Links < 5.2.7

Application Links 5.3.0

Application Links < 5.3.4

References

https://ecosystem.atlassian.net/browse/APL-1363
x_refsource_CONFIRM
http://www.securityfocus.com/bid/104188
vdb-entryx_refsource_BID

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.