CVE-2017-18111: XEE
The OAuthHelper in Atlassian Application Links before version 5.0.10, from version 5.1.0 before version 5.1.3, and from version 5.2.0 before version 5.2.6 used an XML document builder that was vulnerable to XXE when consuming a client OAuth request. This allowed malicious oauth application linked applications to probe internal network resources by requesting internal locations, read the contents of files and also cause an out of memory exception affecting availability via an XML External Entity vulnerability.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID of this issue?
The vulnerability ID of this issue is CVE-2017-18111.
What is the severity of CVE-2017-18111?
The severity of CVE-2017-18111 is high.
Which software versions are affected by CVE-2017-18111?
CVE-2017-18111 affects Atlassian Application Links versions between 5.0.10 and 5.1.3, as well as versions between 5.2.0 and 5.2.6.
What is the vulnerability description for CVE-2017-18111?
CVE-2017-18111 is a vulnerability in the OAuthHelper component of Atlassian Application Links that allowed malicious oauth application linked API requests to trigger an XML External Entity (XXE) attack.
Is there a fix available for CVE-2017-18111?
Yes, the fix for CVE-2017-18111 is available in Atlassian Application Links version 5.0.10, version 5.1.3, and version 5.2.6.