search

google / tsunami-security-scanner-plugins

This project aims to provide a central repository for many useful Tsunami Security Scanner plugins.
Apache License 2.0
860 stars 178 forks source link

PRP: CVE-2019-8451: Atlassian Jira pre auth SSRF #382

Open vishwaraj101 opened 5 months ago

vishwaraj101 commented 5 months ago

Summary: CVE-2019-8451 is a pre-authentication server side request forgery (SSRF) vulnerability found in the /plugins/servlet/gadgets/makeRequest resource. This vulnerability was introduced in Jira server version 7.6. 0, and fixed in versions 7.13. 9 and 8.4.

The /plugins/servlet/gadgets/makeRequest resource in Jira before version 8.4.0 allows remote attackers to access the content of internal network resources via a Server Side Request Forgery (SSRF) vulnerability due to a logic bug in the JiraWhitelist class.

Reference: https://nvd.nist.gov/vuln/detail/CVE-2019-8451