CVE-2019-3402

MEDIUMNuclei

Jira < 8.1.1 - Cross-Site Scripting

Title source: github.com
STIX 2.1 vulnerability

Record summary

CVE-2019-3402 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

The ConfigurePortalPages.jspa resource in Jira before version 7.13.3 and from version 8.0.0 before version 8.1.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the searchOwnerUserName parameter.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Affected products and versions

1
ProductSourceVersion range

Jira

Browse Atlassian / Jira
CVE ListBefore 7.13.3affected
8.0.0affected
Before 8.1.1affected

Nuclei templates

1
ProjectDiscoveryMEDIUMJira < 8.1.1 - Cross-Site ScriptingCVSS 6.1

Jira before 8.1.1 contains a cross-site scripting vulnerability via ConfigurePortalPages.jspa resource in the searchOwnerUserName parameter.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim's browser, leading to potential session hijacking, data theft, or defacement.

Remediation

Upgrade Jira to version 8.1.1 or later to mitigate this vulnerability.

WeaknessesCWE-79
Authorspdteam
Template tagscvecve2019atlassianjiraxssvuln
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:atlassian:jira:*:*:*:*:*:*:*:*
Shodan: http.component:"Atlassian Jira"
Shodan: http.component:"atlassian jira"
Shodan: http.component:"atlassian confluence"
Shodan: cpe:"cpe:2.3:a:atlassian:jira"
https://gist.github.com/0x240x23elu/891371d46a1e270c7bdded0469d8e09c https://jira.atlassian.com/browse/JRASERVER-69243 https://nvd.nist.gov/vuln/detail/CVE-2019-3402 https://github.com/ARPSyndicate/cvemon https://github.com/Faizee-Asad/JIRA-Vulnerabilities

Source: ProjectDiscovery

References

2