PT-2018-6675 · Atlassian+1 · Application Links+1

Publicado 2018-04-04 · Atualizado 2018-05-10 · CVE-2017-18096

Positive Technologies (AI Summary)

CVSS v3.1

7.2

Alta

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Atlassian Application Links versions prior to 5.2.7 Atlassian Application Links versions 5.3.0 through 5.3.3 Atlassian Application Links versions 5.4.0 through 5.4.2

Description: The issue allows remote attackers with administrative rights to access internal network resources via a Server Side Request Forgery (SSRF) by creating an OAuth application link to a location they control and then redirecting access from the linked location's OAuth status rest resource to an internal location. This flaw can be used to access a metadata resource that provides access credentials and other potentially confidential information, especially in environments like Amazon EC2.

Recommendations: For versions prior to 5.2.7, update to version 5.2.7 or later. For versions 5.3.0 through 5.3.3, update to version 5.3.4 or later. For versions 5.4.0 through 5.4.2, update to version 5.4.3 or later.

Correção

SSRF

Enumeração de Fraquezas

CWE-918

Identificadores relacionados

CVE-2017-18096

Produtos afetados

Amazon Ec2

Application Links

Referências · 3

• https://nvd.nist.gov/vuln/detail/CVE-2017-18096 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-18096 · Aviso do Fabricante
• https://ecosystem.atlassian.net/browse/APL-1359 · Aviso do Fabricante