CVE-2019-8451 is a Server-Side Request Forgery (SSRF) vulnerability affecting Atlassian Jira Server versions prior to 8.4.0, stemming from a logic flaw in the JiraWhitelist class. This flaw allows unauthenticated remote attackers to access internal network resources. With a CVSS score of 6.5 (Medium), it has a low attack complexity and no user interaction required, potentially leading to information disclosure and limited integrity impact. While there is no known active exploitation in the KEV catalog or public Metasploit modules, a Nuclei template exists, and it has garnered significant community discussion and media coverage, indicating awareness and potential for future exploitation.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 7.6.0, < 8.4.0CPE matchmatch criteria | cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:* | ||
< 8.4.0CPE match | cpe:2.3:a:atlassian:jira:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.4 GitHub mentions.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.