CVE-2017-18111 XML external entity in Application Links
An XXE vulnerability in Atlassian Application Links allows attackers to read internal files, probe network resources, and cause denial of service.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2017-18111?
CVE-2017-18111 is a high-severity vulnerability in Atlassian Application Links, published on 29 Mar 2019. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
The OAuthHelper in Atlassian Application Links before version 5.0.10, from version 5.1.0 before version 5.1.3, and from version 5.2.0 before version 5.2.6 used an XML document builder that was vulnerable to XXE when consuming a client OAuth request. This allowed malicious oauth application linked applications to probe internal network resources by requesting internal locations, read the contents of files and also cause an out of memory exception affecting availability via an XML External Entity vulnerability.
Weakness: CWE-611
Which versions are affected by CVE-2017-18111?
It affects 1 product.
Products include Atlassian Application Links.
How do I fix CVE-2017-18111?
No fix has been published for CVE-2017-18111 yet. Limit exposure of the affected software until one is available.
Is CVE-2017-18111 being exploited?
There is no known exploitation of CVE-2017-18111 in the wild and no public exploit code.
Other vulnerabilities in Atlassian Application Links
- CVE-2017-18096 Server-side request forgery in Atlassian Application Links
- CVE-2017-16860 Cross-site scripting in Application Links
- CVE-2018-20239 Cross-site scripting in Atlassian Application Links
- CVE-2019-20105 Missing authorization in Application Links
- CVE-2018-5227 Cross-site scripting in Atlassian Application Links
Sources
Also known as GHSA-9563-9277-f9w9.