CVE-2019-3402

Think of Jira as a building’s lobby website, where people click links and see pages. In this vulnerability, a bad link can trick a visitor’s browser into running attacker-controlled scripts while they’re using the Jira portal. That can lead to the attacker manipulating what the user sees or, in some cases, stealing what the browser can access.

This matters if you run Atlassian Jira or Jira Server and your version is prior to 7.13.3, or in the 8.0.0 through 8.1.0 range. There’s no need for the attacker to log in to Jira, but the victim does have to open a crafted link for the injected web content to execute. It’s a risk when your Jira is reachable to users who could be tricked into clicking attacker-made links, and when your installed version falls in the affected range.

This is an Amber issue because it enables remote attackers to run malicious scripts in a user’s browser via crafted links. Even though it requires the victim to click, attackers can target users who visit Jira portals, making the risk practical for businesses using vulnerable Jira versions. Fixing the affected version range should be scheduled promptly.

Confirm whether you’re affected

1. Identify which product you run: Jira vs Jira Server.
2. Check the installed Jira version.
3. Mark the instance as vulnerable if it is:
   • Jira: any version before 7.13.3
   • Jira Server: 8.0.0 up to (but not including) 8.1.1

Upgrade to the fixed version

1. Jira: upgrade to 7.13.3.
2. Jira Server: upgrade to 8.1.1.
3. Follow Atlassian’s upgrade guidance for your specific major/minor version path (including backups and any required intermediate upgrades).

Temporary workaround (if you cannot patch immediately)

• Reduce exposure of portal functionality to untrusted traffic as much as possible (for example, limit who can access the Jira portal pages from the broader internet, and avoid exposing them through overly permissive external access). This does not replace upgrading, but it reduces the chance victims will reach the vulnerable page via the attacker’s crafted link.

What to monitor after patching

• Verify Jira is now running on the fixed version you targeted.
• Watch for unusual portal activity around the time of any suspected phishing attempts (for example, unexpected user actions that correlate with externally received links).

CISA KEV

• This issue is not listed in the provided CISA KEV findings, so treat it as patch-important based on the vulnerability’s impact and realistic attack pattern, not because it’s confirmed KEV exploitation.

CVE-2019-3402 is a CWE-79 (cross-site scripting) vulnerability affecting the ConfigurePortalPages.jspa resource in Atlassian Jira. The mechanism is injection of attacker-controlled HTML/JavaScript via the searchOwnerUserName parameter in the portal configuration flow.

Exposure prerequisites from the findings:

• Remote attacker can trigger via network-delivered crafted link.
• No authentication is required for the attacker.
• Victim interaction is required (a user must open/click the crafted link).
• The instance must be running a vulnerable Jira version (before 7.13.3, or between 8.0.0 and 8.1.1).

Fix status from findings:

• Jira fixed in 7.13.3.
• Jira Server fixed in 8.1.1.

Exploitation maturity:

• No KEV listing was provided, and exploitation details are limited to a detection template (no specific in-the-wild confirmation in the provided findings). Therefore, urgency is driven by the vulnerability type (browser script injection) and the clear victim-interaction attack pattern. EPSS is provided only as a prediction and should not be treated as evidence of active exploitation.