Description

The /plugins/servlet/gadgets/makeRequest resource in Jira before version 8.7.0 allows remote attackers to access the content of internal network resources via a Server Side Request Forgery (SSRF) vulnerability due to a logic bug in the JiraWhitelist class.

Remediation

References

CVE-2019-20408

Related Vulnerabilities

Magento Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2019-8155)

Atlassian Jira Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2021-26078)

Moodle Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2016-2157)

WordPress Plugin Ninja Forms with File Uploads Extension Cross-Site Scripting (3.3.12)

WordPress Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2018-20151)

Severity

Medium

Classification

CVE-2019-20408 CWE-918

Tags

Missing Update Known Vulnerabilities