Description
The ConfigurePortalPages.jspa resource in Jira before version 7.13.3 and from version 8.0.0 before version 8.1.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the searchOwnerUserName parameter.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Atlassian | Jira | unspecified – < 7.13.3, 8.0.0 – < unspecified, unspecified – < 8.1.1 | 7.13.3 |
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Jira < 8.1.1 - Cross-Site Scripting http/cves/2019/CVE-2019-3402.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.