Jira Mcp Server
Monthly
Server-side request forgery in KS-GEN-AI jira-mcp-server 0.2.0 allows a local low-privileged attacker to make the server issue arbitrary HTTP requests by manipulating the imageUrl argument passed to axios.get within the add_attachment_from_public_url function. The CVSS 4.0 vector (AV:L/PR:L/E:P) confirms local access is required, low privileges suffice, and proof-of-concept code exists. No vendor patch has been released; the project maintainer had not responded to the responsible disclosure issue at time of analysis.
Server-side request forgery in KS-GEN-AI jira-mcp-server 0.2.0 allows a local low-privileged attacker to make the server issue arbitrary HTTP requests by manipulating the imageUrl argument passed to axios.get within the add_attachment_from_public_url function. The CVSS 4.0 vector (AV:L/PR:L/E:P) confirms local access is required, low privileges suffice, and proof-of-concept code exists. No vendor patch has been released; the project maintainer had not responded to the responsible disclosure issue at time of analysis.