CVE-2017-18097: The Trello board importer resource in Atlassian Jira before version 7.6.1 allows remote attackers who can c...

Security readout for executives and security teams

Older Atlassian Jira versions could run attacker-supplied HTML or JavaScript if a Jira administrator imported a malicious Trello board. The attacker needs social engineering and admin action, so this is not a typical unauthenticated drive-by issue, but it can affect administrator sessions and Jira trust boundaries. Exposure is likely limited to Jira deployments older than 7.6.1 that used or still allow the Trello board importer. Risk depends on whether administrators imported boards from untrusted or attacker-controlled sources. Handle as a moderate hygiene and trust-boundary risk. Prioritize remediation for any internet-facing or administrator-heavy Jira instance still below 7.6.1, especially where Trello imports were used. Mitigation focus: Upgrade Jira to version 7.6.1 or later where applicable.; Review Atlassian guidance for supported fixed versions and deployment-specific instructions.; Restrict Trello imports to trusted administrators and trusted board sources..

Prepared

Jun 7, 2026, 14:03 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.