Atlassian OAuth Server-Side Request Forgery Vulnerability

🗓️ 24 Aug 2017 00:00:00Reported by China National Vulnerability DatabaseType

Atlassian plugin vulnerability enables remote access and cross site scripting via IconUriServlet.

Reporter	Title	Published	Views	Family All 26
Atlassian	The bundled Atlassian OAuth plugin allows arbitrary HTTP requests to be proxied - CVE-2017-9506	30 Aug 201702:06	–	atlassian
Atlassian	The bundled Atlassian OAuth plugin allows arbitrary HTTP requests to be proxied - CVE-2017-9506	21 Mar 201720:59	–	atlassian
Atlassian	The bundled Atlassian OAuth plugin allows arbitrary HTTP requests to be proxied - CVE-2017-9506	30 Aug 201702:12	–	atlassian
Atlassian	The bundled Atlassian Activity Streams plugin had Improper Access control inside several rest inline action resource resource - CVE-2017-9506	21 Sep 201700:10	–	atlassian
Atlassian	The bundled Atlassian OAuth plugin allows arbitrary HTTP requests to be proxied - CVE-2017-9506	30 Aug 201702:06	–	atlassian
Atlassian	The bundled Atlassian OAuth plugin allows arbitrary HTTP requests to be proxied - CVE-2017-9506	21 Mar 201720:59	–	atlassian
Atlassian	The bundled Atlassian OAuth plugin allows arbitrary HTTP requests to be proxied - CVE-2017-9506	30 Aug 201702:12	–	atlassian
Atlassian	The bundled Atlassian Activity Streams plugin had Improper Access control inside several rest inline action resource resource - CVE-2017-9506	21 Sep 201700:10	–	atlassian
Tenable Nessus	Atlassian Bamboo < 6.0.0 OAuth plugin allows arbitrary HTTP requests to be proxied	28 Jun 201800:00	–	nessus
Tenable Nessus	Atlassian Bitbucket < 4.14.4 OAuth Plugin IconUriServlet Internal Network Resource Disclosure CSRF	28 Jun 201800:00	–	nessus