CVE-2017-16860

6.1MEDIUM

Key Information:

Vendor
Atlassian
Status
Application Links
Vendor
CVE Published:
14 May 2018

Summary

The invalidRedirectUrl template in Atlassian Application Links before version 5.2.7, from version 5.3.0 before version 5.3.4 and from version 5.4.0 before version 5.4.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the redirectUrl parameter link in the redirect warning message.

Affected Version(s)

Application Links < 5.2.7

Application Links 5.3.0

Application Links < 5.3.4

References

https://ecosystem.atlassian.net/browse/APL-1363
x_refsource_CONFIRM
http://www.securityfocus.com/bid/104188
vdb-entryx_refsource_BID

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.