In JetBrains YouTrack before 2020.2.10514, SSRF is possible because URL filtering can be escaped.
Source: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15822
Reference (s):
- https://blog.jetbrains.com/blog/2020/08/06/jetbrains-security-bulletin-q2-2020/
- https://blog.jetbrains.com