Servers and applications

CVE-2019-8451

The /plugins/servlet/gadgets/makeRequest resource in Jira before version 8.4.0 allows remote attackers to access the content of internal network resources via a Server Side Request Forgery (SSRF) vulnerability due to a logic bug in the JiraWhitelist class.

Severity: Medium 6.5
Published: 11 Sept 2019
Last changed: 17 Jun 2026
Added to UpHeron: 1 Nov 2026
Fixed in: 8.4.0
Exploit chance: 94% in the next 30 daysHigher than 99% of CVEs. EPSS by FIRST, 10 Nov 2026
Weakness: Server-side request forgery (CWE-918)
Attack: Over the network · No login needed · No user action needed
Attacker can: Read some data · Change some data
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Sources: NVD

Affected software

Software	Affected versions
JiraServers and applications · `cpe:a:atlassian:jira_server`	From 7.6.0 before 8.4.0

References

NVD https://nvd.nist.gov/vuln/detail/CVE-2019-8451
CVE.org https://www.cve.org/CVERecord?id=CVE-2019-8451