CVE-2017-9506
The IconUriServlet of the Atlassian OAuth Plugin from version 1.3.0 before version 1.9.12 and...
The IconUriServlet of the Atlassian OAuth Plugin from version 1.3.0 before version 1.9.12 and from version 2.0.0 before version 2.0.4 allows remote attackers to access the content of internal network resources and/or perform an XSS attack via Server Side Request Forgery (SSRF).
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
The IconUriServlet of the Atlassian OAuth Plugin from version 1.3.0 before version 1.9.12 and from version 2.0.0 before version 2.0.4 allows remote attackers to access the content of internal network resources and/or perform an XSS attack via Server Side Request Forgery (SSRF).
- Record
CVE-2017-9506- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-918
- Updated
- 2026-11-02
CVE List No score
The IconUriServlet of the Atlassian OAuth Plugin from version 1.3.0 before version 1.9.12 and from version 2.0.0 before version 2.0.4 allows remote attackers to access the content of internal network resources and/or perform an XSS attack via Server Side Request Forgery (SSRF).
- Record
CVE-2017-9506- Updated
- 2026-11-02
EUVDEUVD-2017-18438 No score
The IconUriServlet of the Atlassian OAuth Plugin from version 1.3.0 before version 1.9.12 and from version 2.0.0 before version 2.0.4 allows remote attackers to access the content of internal network resources and/or perform an XSS attack via Server Side Request Forgery (SSRF).
- Record
EUVD-2017-18438- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-wr82-63qc-g2h8
The IconUriServlet of the Atlassian OAuth Plugin from version 1.3.0 before version 1.9.12 and...
The IconUriServlet of the Atlassian OAuth Plugin from version 1.3.0 before version 1.9.12 and from version 2.0.0 before version 2.0.4 allows remote attackers to access the content of internal network resources and/or perform an XSS attack via Server Side Request Forgery (SSRF).
- Record
GHSA-wr82-63qc-g2h8- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-918
- Updated
- 2026-11-02
OSV
The IconUriServlet of the Atlassian OAuth Plugin from version 1.3.0 before version 1.9.12 and from version 2.0.0 before version 2.0.4 allows remote attackers to access the content of internal network resources and/or perform an XSS attack via Server Side Request Forgery (SSRF).
- Record
CVE-2017-9506- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Nuclei | Atlassian Jira IconURIServlet - Cross-Site Scripting/Server-Side Request Forgery | |
| PoC in GitHub | labsbots/CVE-2017-9506 | 2022-04-03 |
| PoC in GitHub | pwn1sher/jira-ssrf | 2019-10-21 |
| PoC in GitHub | random-robbie/Jira-Scan | 2018-04-25 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, Nuclei, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-9506 is a medium vulnerability (CVSS 6.1) in Atlassian Oauth Plugin, published August 23, 2017. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 71.6%, the 99th percentile. No source names a fixed version.
References
dontpanic.42.nl/2017/12/there-is-proxy-in-your-atlassian.html
twitter.com/ankit_anubhav/status/973566620676382721
ecosystem.atlassian.net/browse/OAUTH-344
medium.com/bugbountywriteup/piercing-the-veil-server-side-request-forgery-to-niprnet-access-171018bca2c3
nvd.nist.gov/vuln/detail/CVE-2017-9506
github.com/advisories/GHSA-wr82-63qc-g2h8