Read the docs
TI-2017-13304 Aliases CVE-2017-18096GHSA-3jwg-839p-m5gf

Server-side request forgery in Atlassian Application Links

Priority LOW 34CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA.

Summary

The OAuth status rest resource in Atlassian Application Links before version 5.2.7, from 5.3.0 before 5.3.4 and from 5.4.0 before 5.4.3 allows remote attackers with administrative rights to access the content of internal network resources via a Server Side Request Forgery (SSRF) by creating an OAuth application link to a location they control and then redirecting access from the linked location's OAuth status rest resource to an internal location. When running in an environment like Amazon EC2, this flaw maybe used to access to a metadata resource that provides access credentials and other potentially confidential information.

Why it matters now

EPSS 0.01189 68th percentileScored 2026-11-07
Fix Fixed Atlassian Application Links (Atlassian): 5.2.7, 5.3.4, 5.4.3

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
AtlassianAtlassian Application Linksbefore 5.2.7; 5.3.0 and later; before 5.3.4; 5.4.0 and later; before 5.4.35.2.7, 5.3.4, 5.4.3Patch availableCNA
  • Atlassian Application Links VendorAtlassian Affected before 5.2.7; 5.3.0 and later; before 5.3.4; 5.4.0 and later; before 5.4.3 Fixed in 5.2.7, 5.3.4, 5.4.3 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:atlassian:application_links:*:*:*:*:*:*:*:*before 5.2.7; 5.3.0 to before 5.3.4; 5.4.0 to before 5.4.3VulnerableAtlassian
  • cpe:2.3:a:atlassian:application_links:*:*:*:*:*:*:*:* Versions before 5.2.7; 5.3.0 to before 5.3.4; 5.4.0 to before 5.4.3 Vulnerable ·Atlassian

Remediation

  • Fix · CNA Atlassian Application Links (Atlassian) Fixed in 5.2.7, 5.3.4, 5.4.3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-18096
  2. 2026-10-03 Alias added: GHSA-3jwg-839p-m5gf

References

Advisory 1

  • TI-2017-13318 XML external entity injection in Atlassian Application Links CVSS 3.0HIGH 8.7
  • TI-2018-14346 Cross-site scripting in Atlassian Application Links CVSS 3.1MEDIUM 5.4
  • TI-2017-12406 Cross-site scripting in Atlassian Application Links CVSS 3.0MEDIUM 6.1
  • TI-2019-14513 Missing authentication in Atlassian Application Links CVSS 3.1MEDIUM 4.9
  • TI-2018-03784 Cross-site scripting in Atlassian Application Links CVSS 3.0MEDIUM 4.8
  • TI-2019-11197 Incorrect default permissions in Atlassian Application Links CVSS 3.1MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences