CyberRota Analysis
AI-GeneratedA server-side request forgery vulnerability exists in the KS-GEN-AI jira-mcp-server version 0.2.0, specifically in the axios.get function within the add_attachment_from_public_url component. This flaw allows an attacker to manipulate the imageUrl argument, potentially leading to unauthorized access to internal resources. Organizations using this version of the software should prioritize remediation to mitigate the risk of local exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A vulnerability was found in KS-GEN-AI jira-mcp-server 0.2.0. This affects the function axios.get of the file src/index.ts of the component add_attachment_from_public_url. The manipulation of the argument imageUrl results in server-side request forgery. The attack requires a local approach. The project was informed of the problem early through an issue report but has not responded yet.