CVE-2019-8451

Description

The /plugins/servlet/gadgets/makeRequest resource in Jira before version 8.4.0 allows remote attackers to access the content of internal network resources via a Server Side Request Forgery (SSRF) vulnerability due to a logic bug in the JiraWhitelist class.

Affected products

Vendor	Product	Affected	Fixed
Atlassian	Jira	unspecified – < 8.4.0	8.4.0

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 5 repositories

jas502n/CVE-2019-8451 ★ 30 · Sep 26, 2019

Jira未授权SSRF漏洞
0xbug/CVE-2019-8451 ★ 11 · Sep 16, 2019

https://jira.atlassian.com/browse/JRASERVER-69793
h0ffayyy/Jira-CVE-2019-8451 ★ 7 · Sep 28, 2019

POC to check for Jira instances vulnerable to CVE-2019-8451
ianxtianxt/CVE-2019-8451 ★ 1 · Sep 24, 2019
iuds/CVE-2019-8451 ★ 0 · Nov 24, 2025

exploit for atlassian jira server SSRF

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Automated scanner template

A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.

Jira <8.4.0 - Server-Side Request Forgery http/cves/2019/CVE-2019-8451.yaml

Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.

References

https://jira.atlassian.com/browse/JRASERVER-69793