The MessageBundleWhiteList class of atlassian-gadgets before version 4.2.37, from version 4.3.0 before 4.3.14, from version 4.3.2.0 before 4.3.2.4, from version 4.4.0 before 4.4.12, and from version 5.0.0 before 5.0.1 allowed unexpected DNS lookups and requests to arbitrary services as it incorrectly obtained application base url information from the executing http request which could be attacker controlled.

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is prior to 8.5.10, 8.6.x < 8.13.2 or 8.14.x < 8.14.1. It is, therefore, affected by a Server-Side Request Forgery (SSRF) vulnerability allowing unexpected DNS lookups and requests to malicious servers.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
112841	Atlassian Jira 8.14.x < 8.14.1 Server-Side Request Forgery	Web App Scanning	Component Vulnerability	medium
112840	Atlassian Jira 8.6.x < 8.13.2 Server-Side Request Forgery	Web App Scanning	Component Vulnerability	medium
112839	Atlassian Jira < 8.5.10 Server-Side Request Forgery	Web App Scanning	Component Vulnerability	medium

Detections

Analytics

CVE-2020-36232

medium

Tenable Plugins

medium

medium

medium