Uploaded image for project: 'Jira Data Center'
  1. Jira Data Center
  2. JRASERVER-71204

SSRF in Dashboard & Gadgets - CVE-2019-20408

XMLWordPrintable

      The /plugins/servlet/gadgets/makeRequest resource in Jira before version 8.7.0 allows remote attackers to access the content of internal network resources via a Server Side Request Forgery (SSRF) vulnerability due to a logic bug in the JiraWhitelist class.

      As an example to indicate impact, when running the vulnerable version of Jira in an environment like Amazon EC2, this flaw may be used to access to a metadata resource that provides access credentials and other potentially confidential information.

      Affected versions:

      • version < 8.7.0

      Fixed versions:

      • 8.7.0

            [JRASERVER-71204] SSRF in Dashboard & Gadgets - CVE-2019-20408

            No work has yet been logged on this issue.

              mmarzecki Mateusz Marzęcki
              security-metrics-bot Security Metrics Bot
              Affected customers:
              0 This affects my team
              Watchers:
              18 Start watching this issue

                Created:
                Updated:
                Resolved: