Read the docs
TI-2017-06913 Aliases CVE-2017-9506GHSA-wr82-63qc-g2h8

Server-side request forgery in Atlassian OAuth Plugin

Priority HIGH 65CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · Low · None
Fix status
No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA.

Summary

The IconUriServlet of the Atlassian OAuth Plugin from version 1.3.0 before version 1.9.12 and from version 2.0.0 before version 2.0.4 allows remote attackers to access the content of internal network resources and/or perform an XSS attack via Server Side Request Forgery (SSRF).

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.71601 99th percentileScored 2026-11-07
Public exploit Yes 3 exploit referencesTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
AtlassianAtlassian OAuth PluginFrom version 1.3.0 before version 1.9.12 and from version 2.0.0 before version 2.0.4.—No fix listedCNA
  • Atlassian OAuth Plugin VendorAtlassian Affected From version 1.3.0 before version 1.9.12 and from version 2.0.0 before version 2.0.4. Fixed in — No fix listed CNA

CPE configurations NVD · 48

CPEVersionsRoleVendor
cpe:2.3:a:atlassian:oauth:1.3.0:*:*:*:*:*:*:*1.3.0VulnerableAtlassian
cpe:2.3:a:atlassian:oauth:1.3.1:*:*:*:*:*:*:*1.3.1VulnerableAtlassian
cpe:2.3:a:atlassian:oauth:1.3.2:*:*:*:*:*:*:*1.3.2VulnerableAtlassian
cpe:2.3:a:atlassian:oauth:1.3.3:*:*:*:*:*:*:*1.3.3VulnerableAtlassian
cpe:2.3:a:atlassian:oauth:1.3.4:*:*:*:*:*:*:*1.3.4VulnerableAtlassian
cpe:2.3:a:atlassian:oauth:1.3.5:*:*:*:*:*:*:*1.3.5VulnerableAtlassian
cpe:2.3:a:atlassian:oauth:1.3.6:*:*:*:*:*:*:*1.3.6VulnerableAtlassian
cpe:2.3:a:atlassian:oauth:1.3.7:*:*:*:*:*:*:*1.3.7VulnerableAtlassian
cpe:2.3:a:atlassian:oauth:1.3.8:*:*:*:*:*:*:*1.3.8VulnerableAtlassian
cpe:2.3:a:atlassian:oauth:1.3.9:*:*:*:*:*:*:*1.3.9VulnerableAtlassian
  • cpe:2.3:a:atlassian:oauth:1.3.0:*:*:*:*:*:*:* Versions 1.3.0 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:oauth:1.3.1:*:*:*:*:*:*:* Versions 1.3.1 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:oauth:1.3.2:*:*:*:*:*:*:* Versions 1.3.2 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:oauth:1.3.3:*:*:*:*:*:*:* Versions 1.3.3 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:oauth:1.3.4:*:*:*:*:*:*:* Versions 1.3.4 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:oauth:1.3.5:*:*:*:*:*:*:* Versions 1.3.5 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:oauth:1.3.6:*:*:*:*:*:*:* Versions 1.3.6 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:oauth:1.3.7:*:*:*:*:*:*:* Versions 1.3.7 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:oauth:1.3.8:*:*:*:*:*:*:* Versions 1.3.8 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:oauth:1.3.9:*:*:*:*:*:*:* Versions 1.3.9 Vulnerable ·Atlassian
Show 38 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:atlassian:oauth:1.3.10:*:*:*:*:*:*:*1.3.10VulnerableAtlassian
cpe:2.3:a:atlassian:oauth:1.4.0:*:*:*:*:*:*:*1.4.0VulnerableAtlassian
cpe:2.3:a:atlassian:oauth:1.4.0:m1:*:*:*:*:*:*1.4.0 m1VulnerableAtlassian
cpe:2.3:a:atlassian:oauth:1.4.0:m2:*:*:*:*:*:*1.4.0 m2VulnerableAtlassian
cpe:2.3:a:atlassian:oauth:1.4.1:*:*:*:*:*:*:*1.4.1VulnerableAtlassian
cpe:2.3:a:atlassian:oauth:1.5.0:*:*:*:*:*:*:*1.5.0VulnerableAtlassian
cpe:2.3:a:atlassian:oauth:1.5.0:m1:*:*:*:*:*:*1.5.0 m1VulnerableAtlassian
cpe:2.3:a:atlassian:oauth:1.5.0:m3:*:*:*:*:*:*1.5.0 m3VulnerableAtlassian
cpe:2.3:a:atlassian:oauth:1.6.0:*:*:*:*:*:*:*1.6.0VulnerableAtlassian
cpe:2.3:a:atlassian:oauth:1.6.0:m1:*:*:*:*:*:*1.6.0 m1VulnerableAtlassian
cpe:2.3:a:atlassian:oauth:1.6.0:m4:*:*:*:*:*:*1.6.0 m4VulnerableAtlassian
cpe:2.3:a:atlassian:oauth:1.6.1:*:*:*:*:*:*:*1.6.1VulnerableAtlassian
cpe:2.3:a:atlassian:oauth:1.7.0:*:*:*:*:*:*:*1.7.0VulnerableAtlassian
cpe:2.3:a:atlassian:oauth:1.8.0:*:*:*:*:*:*:*1.8.0VulnerableAtlassian
cpe:2.3:a:atlassian:oauth:1.8.0:m1:*:*:*:*:*:*1.8.0 m1VulnerableAtlassian
cpe:2.3:a:atlassian:oauth:1.8.1:*:*:*:*:*:*:*1.8.1VulnerableAtlassian
cpe:2.3:a:atlassian:oauth:1.8.2:*:*:*:*:*:*:*1.8.2VulnerableAtlassian
cpe:2.3:a:atlassian:oauth:1.8.3:*:*:*:*:*:*:*1.8.3VulnerableAtlassian
cpe:2.3:a:atlassian:oauth:1.8.4:*:*:*:*:*:*:*1.8.4VulnerableAtlassian
cpe:2.3:a:atlassian:oauth:1.8.5:*:*:*:*:*:*:*1.8.5VulnerableAtlassian
cpe:2.3:a:atlassian:oauth:1.9.0:*:*:*:*:*:*:*1.9.0VulnerableAtlassian
cpe:2.3:a:atlassian:oauth:1.9.0:m1:*:*:*:*:*:*1.9.0 m1VulnerableAtlassian
cpe:2.3:a:atlassian:oauth:1.9.0:m2:*:*:*:*:*:*1.9.0 m2VulnerableAtlassian
cpe:2.3:a:atlassian:oauth:1.9.1:*:*:*:*:*:*:*1.9.1VulnerableAtlassian
cpe:2.3:a:atlassian:oauth:1.9.2:*:*:*:*:*:*:*1.9.2VulnerableAtlassian
cpe:2.3:a:atlassian:oauth:1.9.3:*:*:*:*:*:*:*1.9.3VulnerableAtlassian
cpe:2.3:a:atlassian:oauth:1.9.4:*:*:*:*:*:*:*1.9.4VulnerableAtlassian
cpe:2.3:a:atlassian:oauth:1.9.5:*:*:*:*:*:*:*1.9.5VulnerableAtlassian
cpe:2.3:a:atlassian:oauth:1.9.6:*:*:*:*:*:*:*1.9.6VulnerableAtlassian
cpe:2.3:a:atlassian:oauth:1.9.7:*:*:*:*:*:*:*1.9.7VulnerableAtlassian
cpe:2.3:a:atlassian:oauth:1.9.8:*:*:*:*:*:*:*1.9.8VulnerableAtlassian
cpe:2.3:a:atlassian:oauth:1.9.9:*:*:*:*:*:*:*1.9.9VulnerableAtlassian
cpe:2.3:a:atlassian:oauth:1.9.10:*:*:*:*:*:*:*1.9.10VulnerableAtlassian
cpe:2.3:a:atlassian:oauth:1.9.11:*:*:*:*:*:*:*1.9.11VulnerableAtlassian
cpe:2.3:a:atlassian:oauth:2.0.0:*:*:*:*:*:*:*2.0.0VulnerableAtlassian
cpe:2.3:a:atlassian:oauth:2.0.1:*:*:*:*:*:*:*2.0.1VulnerableAtlassian
cpe:2.3:a:atlassian:oauth:2.0.2:*:*:*:*:*:*:*2.0.2VulnerableAtlassian
cpe:2.3:a:atlassian:oauth:2.0.3:*:*:*:*:*:*:*2.0.3VulnerableAtlassian
  • cpe:2.3:a:atlassian:oauth:1.3.10:*:*:*:*:*:*:* Versions 1.3.10 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:oauth:1.4.0:*:*:*:*:*:*:* Versions 1.4.0 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:oauth:1.4.0:m1:*:*:*:*:*:* Versions 1.4.0 m1 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:oauth:1.4.0:m2:*:*:*:*:*:* Versions 1.4.0 m2 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:oauth:1.4.1:*:*:*:*:*:*:* Versions 1.4.1 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:oauth:1.5.0:*:*:*:*:*:*:* Versions 1.5.0 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:oauth:1.5.0:m1:*:*:*:*:*:* Versions 1.5.0 m1 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:oauth:1.5.0:m3:*:*:*:*:*:* Versions 1.5.0 m3 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:oauth:1.6.0:*:*:*:*:*:*:* Versions 1.6.0 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:oauth:1.6.0:m1:*:*:*:*:*:* Versions 1.6.0 m1 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:oauth:1.6.0:m4:*:*:*:*:*:* Versions 1.6.0 m4 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:oauth:1.6.1:*:*:*:*:*:*:* Versions 1.6.1 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:oauth:1.7.0:*:*:*:*:*:*:* Versions 1.7.0 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:oauth:1.8.0:*:*:*:*:*:*:* Versions 1.8.0 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:oauth:1.8.0:m1:*:*:*:*:*:* Versions 1.8.0 m1 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:oauth:1.8.1:*:*:*:*:*:*:* Versions 1.8.1 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:oauth:1.8.2:*:*:*:*:*:*:* Versions 1.8.2 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:oauth:1.8.3:*:*:*:*:*:*:* Versions 1.8.3 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:oauth:1.8.4:*:*:*:*:*:*:* Versions 1.8.4 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:oauth:1.8.5:*:*:*:*:*:*:* Versions 1.8.5 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:oauth:1.9.0:*:*:*:*:*:*:* Versions 1.9.0 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:oauth:1.9.0:m1:*:*:*:*:*:* Versions 1.9.0 m1 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:oauth:1.9.0:m2:*:*:*:*:*:* Versions 1.9.0 m2 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:oauth:1.9.1:*:*:*:*:*:*:* Versions 1.9.1 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:oauth:1.9.2:*:*:*:*:*:*:* Versions 1.9.2 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:oauth:1.9.3:*:*:*:*:*:*:* Versions 1.9.3 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:oauth:1.9.4:*:*:*:*:*:*:* Versions 1.9.4 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:oauth:1.9.5:*:*:*:*:*:*:* Versions 1.9.5 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:oauth:1.9.6:*:*:*:*:*:*:* Versions 1.9.6 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:oauth:1.9.7:*:*:*:*:*:*:* Versions 1.9.7 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:oauth:1.9.8:*:*:*:*:*:*:* Versions 1.9.8 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:oauth:1.9.9:*:*:*:*:*:*:* Versions 1.9.9 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:oauth:1.9.10:*:*:*:*:*:*:* Versions 1.9.10 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:oauth:1.9.11:*:*:*:*:*:*:* Versions 1.9.11 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:oauth:2.0.0:*:*:*:*:*:*:* Versions 2.0.0 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:oauth:2.0.1:*:*:*:*:*:*:* Versions 2.0.1 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:oauth:2.0.2:*:*:*:*:*:*:* Versions 2.0.2 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:oauth:2.0.3:*:*:*:*:*:*:* Versions 2.0.3 Vulnerable ·Atlassian

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-9506
  2. 2026-10-03 Alias added: GHSA-wr82-63qc-g2h8

References

Exploit 3

Advisory 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences