CVE-2019-8451: Jira Server SSRF in makeRequest gadget endpoint

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityUnauthenticated network-reachable SSRF with very high EPSS despite a medium CVSS score and no KEV listing.

What it is

Jira Server before 8.4.0 contains a server-side request forgery flaw in the /plugins/servlet/gadgets/makeRequest resource, caused by a logic bug in the JiraWhitelist class. An unauthenticated remote attacker can make the server fetch internal network resources, exposing content that should not be reachable from outside.

Impact

An attacker gains read access to internal network resources reachable from the Jira server, which can leak internal services, metadata endpoints or configuration data. The CVSS vector also indicates limited integrity impact, so responses may be manipulated in some cases.

Attack surface

Reachable over the network through the makeRequest servlet endpoint with no authentication and no user interaction required, per the CVSS vector AV:N/PR:N/UI:N. Any Jira Server instance exposing that endpoint to untrusted networks is in scope.

Exploitation

Not listed in CISA KEV and no public exploit tag appears in the references, but EPSS is very high at roughly 0.94 probability over 30 days (99.8th percentile), indicating strong likelihood of attempted exploitation.

What to do

• Upgrade Jira Server to version 8.4.0 or later, which fixes the JiraWhitelist logic bug.
• If immediate upgrade is not possible, restrict network access to /plugins/servlet/gadgets/makeRequest at the reverse proxy or WAF.
• Segment the Jira server so it cannot reach sensitive internal services or cloud metadata endpoints.
• Review and tighten outbound egress rules from the Jira host to internal networks.
• Monitor vendor advisory JRASERVER-69793 for any updated guidance.

Detection

• Alert on requests to /plugins/servlet/gadgets/makeRequest, especially with external or unusual URL parameters.
• Monitor Jira server outbound connections to internal RFC1918 addresses, localhost or cloud metadata IPs.
• Correlate Jira access logs with egress firewall or proxy logs for unexpected internal fetches.
• Watch for repeated or parameter-fuzzing requests to the makeRequest endpoint from single source IPs.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.