Apwide Golive CVE-2025-45939

The vulnerability requires access to the Golive plugin's test webhook function. The provided CVSS vector specifies PR:N, suggesting this function may be reachable without authentication - however, this is inconsistent with typical Jira plugin behavior where session authentication is mandatory, and should be independently verified with the vendor. AC:H in the provided vector indicates some complexity barrier exists, possibly that the attacker cannot directly read SSRF responses (blind SSRF) or that specific routing conditions must hold between the Jira server and the target internal host. Exploitation is limited by: the attacker's ability to reach internal resources being dependent on Jira server network placement; blind SSRF conditions (if responses are not reflected) reducing the attacker's ability to exfiltrate data; and cloud metadata protection mechanisms (IMDSv2) that mitigate the most impactful SSRF targets.

The vendor-provided CVSS 3.1 base score of 6.5 with vector AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L presents a notable tension: PR:N implies no authentication is required to invoke the test webhook function, yet this endpoint is embedded in a Jira plugin that ordinarily requires Jira session authentication. This discrepancy should be verified with the vendor - if the endpoint is truly unauthenticated, exploitation risk rises significantly; if authentication is required, the real-world risk is lower than the raw score implies. AC:H suggests additional complexity, possibly reflecting that SSRF response data is not directly reflected to the caller or that specific network conditions must hold. EPSS at 0.29% (20th percentile) signals very low observed exploitation activity consistent with the niche product footprint. No public exploit code exists, and CISA KEV does not list this CVE. The practical risk priority is low-to-moderate for most organizations, elevated only in cloud-hosted Jira environments where SSRF could reach metadata services (AWS IMDSv1, GCP), or in environments with sensitive internal services co-located on the same network segment as the Jira host.

An attacker with access to the Jira instance (or, if PR:N is accurate, without any credentials) navigates to the Golive plugin's webhook test functionality and submits a crafted URL targeting an internal resource such as http://169.254.169.254/latest/meta-data/ on a cloud-hosted Jira instance. The server fetches the URL, potentially returning cloud instance credentials or internal network topology data accessible to the Jira host. No public proof-of-concept code exists at time of analysis, but the technique is well-understood and requires no specialized tooling.