CVE-2019-3402

Think of Jira as a building’s lobby website, where people click links and see pages. In this vulnerability, a bad link can trick a visitor’s browser into running attacker-controlled scripts while they’re using the Jira portal. That can lead to the attacker manipulating what the user sees or, in some cases, stealing what the browser can access.

This matters if you run Atlassian Jira or Jira Server and your version is prior to 7.13.3, or in the 8.0.0 through 8.1.0 range. There’s no need for the attacker to log in to Jira, but the victim does have to open a crafted link for the injected web content to execute. It’s a risk when your Jira is reachable to users who could be tricked into clicking attacker-made links, and when your installed version falls in the affected range.

This is an Amber issue because it enables remote attackers to run malicious scripts in a user’s browser via crafted links. Even though it requires the victim to click, attackers can target users who visit Jira portals, making the risk practical for businesses using vulnerable Jira versions. Fixing the affected version range should be scheduled promptly.