CVE-2019-20408: Atlassian Jira

Medium severity, CVSS 5.3. EPSS: 1% chance of exploitation in the next 30 days.

The /plugins/servlet/gadgets/makeRequest resource in Jira before version 8.7.0 allows remote attackers to access the content of internal network resources via a Server Side Request Forgery (SSRF) vulnerability due to a logic bug in the JiraWhitelist class.

Affected products

• Atlassian Jira: before 8.7.0 (fixed in 8.7.0)

Published 2020-07-01. Last modified 2026-06-17.