First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2019-20408

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

The /plugins/servlet/gadgets/makeRequest resource in Jira before version 8.7.0 allows remote attackers to access the content of internal network resources via a Server Side Request Forgery (SSRF) vulnerability due to a logic bug in the JiraWhitelist class.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

Affected software

Vendor	Product	Versions
Atlassian	Jira Server	>= unspecified, < 8.7.0

References

https://jira.atlassian.com/browse/JRASERVER-71204Issue Tracking, Vendor Advisory
https://jira.atlassian.com/browse/JRASERVER-71204Issue Tracking, Vendor Advisory

Timeline

Published: Jul 1, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-204099.8The way in which velocity templates were used in Atlassian Jira Server and Data Center prior to version 8.8.0 allowed remote attackers to ga CVE-2019-20417.3In the configuration of NFC modules on certain devices, there is a possible failure to distinguish individual devices due to an insecure def CVE-2019-204106.5Affected versions of Atlassian Jira Server and Data Center allow remote attackers to view sensitive information via an Information Disclosur CVE-2019-204114.3Affected versions of Atlassian Jira Server and Data Center allow remote attackers to modify Wallboard settings via a Cross-site request forg CVE-2019-204125.3The Convert Sub-Task to Issue page in affected versions of Atlassian Jira Server and Data Center allow remote attackers to enumerate the fol CVE-2019-204137.5Affected versions of Atlassian Jira Server and Data Center allow remote attackers to impact the application's availability via a Denial of S CVE-2019-204145.4Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a cross site sc CVE-2019-204154.3Atlassian Jira Server and Data Center in affected versions allows remote attackers to modify logging and profiling settings via a cross-site CVE-2019-204164.8Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a cross site sc CVE-2019-204186.5Affected versions of Atlassian Jira Server and Data Center allow remote attackers to prevent users from accessing the instance via an Applic CVE-2019-204197.8Affected versions of Atlassian Jira Server and Data Center allow remote attackers to execute arbitrary code via a DLL hijacking vulnerabilit CVE-2019-204217.5In Jp2Image::readMetadata() in jp2image.cpp in Exiv2 0.27.2, an input file can result in an infinite loop and hang, with high CPU consumptio