{"containers": {"cna": {"affected": [{"product": "Application Links", "vendor": "Atlassian", "versions": [{"lessThan": "5.0.10", "status": "affected", "version": "unspecified", "versionType": "custom"}, {"lessThan": "unspecified", "status": "affected", "version": "5.1.0", "versionType": "custom"}, {"lessThan": "5.1.3", "status": "affected", "version": "unspecified", "versionType": "custom"}, {"lessThan": "unspecified", "status": "affected", "version": "5.2.0", "versionType": "custom"}, {"lessThan": "5.2.6", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "datePublic": "2017-05-31T00:00:00", "descriptions": [{"lang": "en", "value": "The OAuthHelper in Atlassian Application Links before version 5.0.10, from version 5.1.0 before version 5.1.3, and from version 5.2.0 before version 5.2.6 used an XML document builder that was vulnerable to XXE when consuming a client OAuth request. This allowed malicious oauth application linked applications to probe internal network resources by requesting internal locations, read the contents of files and also cause an out of memory exception affecting availability via an XML External Entity vulnerability."}], "problemTypes": [{"descriptions": [{"description": "Improper Restriction of XML External Entity Reference ('XXE')", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2019-03-29T14:04:53", "orgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", "shortName": "atlassian"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://ecosystem.atlassian.net/browse/APL-1338"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@atlassian.com", "DATE_PUBLIC": "2017-05-31T00:00:00", "ID": "CVE-2017-18111", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Application Links", "version": {"version_data": [{"version_affected": "<", "version_value": "5.0.10"}, {"version_affected": ">=", "version_value": "5.1.0"}, {"version_affected": "<", "version_value": "5.1.3"}, {"version_affected": ">=", "version_value": "5.2.0"}, {"version_affected": "<", "version_value": "5.2.6"}]}}]}, "vendor_name": "Atlassian"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The OAuthHelper in Atlassian Application Links before version 5.0.10, from version 5.1.0 before version 5.1.3, and from version 5.2.0 before version 5.2.6 used an XML document builder that was vulnerable to XXE when consuming a client OAuth request. This allowed malicious oauth application linked applications to probe internal network resources by requesting internal locations, read the contents of files and also cause an out of memory exception affecting availability via an XML External Entity vulnerability."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Improper Restriction of XML External Entity Reference ('XXE')"}]}]}, "references": {"reference_data": [{"name": "https://ecosystem.atlassian.net/browse/APL-1338", "refsource": "MISC", "url": "https://ecosystem.atlassian.net/browse/APL-1338"}]}}}}, "cveMetadata": {"assignerOrgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", "assignerShortName": "atlassian", "cveId": "CVE-2017-18111", "datePublished": "2017-05-31T00:00:00", "dateReserved": "2018-02-01T00:00:00", "dateUpdated": "2019-03-29T14:04:53", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:atlassian:application_links:*:*:*:*:*:*:*:*", "matchCriteriaId": "39C7E940-29B1-4A70-82F2-9EBA6A5E75EF", "versionEndExcluding": "5.0.10", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:application_links:*:*:*:*:*:*:*:*", "matchCriteriaId": "8F67A8D7-CB6A-438A-822D-244A84DD4887", "versionEndExcluding": "5.1.3", "versionStartIncluding": "5.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:application_links:*:*:*:*:*:*:*:*", "matchCriteriaId": "EAF55B98-3B2F-44CD-9613-5B5E22786547", "versionEndExcluding": "5.2.6", "versionStartIncluding": "5.2.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "The OAuthHelper in Atlassian Application Links before version 5.0.10, from version 5.1.0 before version 5.1.3, and from version 5.2.0 before version 5.2.6 used an XML document builder that was vulnerable to XXE when consuming a client OAuth request. This allowed malicious oauth application linked applications to probe internal network resources by requesting internal locations, read the contents of files and also cause an out of memory exception affecting availability via an XML External Entity vulnerability."}, {"lang": "es", "value": "OAuthHelper en Atlassian Application Links, en versiones anteriores a la 5.0.10, desde la 5.1.0 hasta la 5.1.3 y desde la 5.2.0 hasta la 5.2.6, utilizaba un constructor de documentos XML que era vulnerable a XEE (XML External Entity) al consumir una petici\u00f3n OAuth del cliente. Esto permit\u00eda a las aplicaciones enlazadas a aplicaciones oauth maliciosas sondear recursos de red internos, solicitando ubicaciones internas, leyendo los contenidos de los archivos y causando una excepci\u00f3n de fuera de memoria mediante una vulnerabilidad de XEE (XML External Entity)."}], "id": "CVE-2017-18111", "lastModified": "2019-04-01T18:41:10.487", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 5.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:P", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 4.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:H", "version": "3.0"}, "exploitabilityScore": 2.3, "impactScore": 5.8, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2019-03-29T14:29:00.483", "references": [{"source": "security@atlassian.com", "tags": ["Vendor Advisory"], "url": "https://ecosystem.atlassian.net/browse/APL-1338"}], "sourceIdentifier": "security@atlassian.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-611"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}