CVE-2017-16860

MEDIUM

Atlassian Application Links <5.2.7, <5.3.0-<5.3.4, <5.4.0-<5.4.3 - XSS

Title source: llm

Description

The invalidRedirectUrl template in Atlassian Application Links before version 5.2.7, from version 5.3.0 before version 5.3.4 and from version 5.4.0 before version 5.4.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the redirectUrl parameter link in the redirect warning message.

References (2)

Core 2

Core References

Third Party Advisory x_refsource_confirm

https://ecosystem.atlassian.net/browse/APL-1363

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/104188

Scores

CVSS v3 6.1

EPSS 0.0023

EPSS Percentile 45.5%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

CWE

CWE-79

Status published

Products (1)

atlassian/application_links < 5.2.7

Published May 14, 2018

Tracked Since Feb 18, 2026