Security readout for executives and security teams
Plain-English summary
A Jira page used for filter selection could mishandle the searchOwnerUserName input and allow attacker-supplied HTML or JavaScript to run in a user's browser. The sources identify this as a cross-site scripting issue fixed in later Jira versions.
Executive priority
Treat this as a timely remediation item for exposed Jira systems, especially if Jira is internet-facing or used by many internal users. There is no cited active exploitation, so urgency should be driven by exposure and upgrade feasibility.
Technical view
CVE-2019-14996 is an XSS vulnerability in Jira's FilterPickerPopup.jspa resource. Jira versions before 7.13.7, and 8.0.0 before 8.3.3, are described as affected. The vulnerable parameter is searchOwnerUserName. No CVSS score or CWE is provided in the bundle.
Likely exposure
Exposure is most likely where affected Jira Server or Data Center instances are reachable by users or attackers who can access the filter picker resource. Public or broadly accessible Jira deployments carry higher business risk.
Exploitation context
The bundle does not show CISA KEV listing or evidence of active exploitation. The issue is remotely reachable according to the CVE description, but no exploit status, preconditions, or attack complexity are provided.
Researcher notes
The source bundle is limited: it provides affected version ranges, vulnerable resource, and parameter, but no CVSS vector, CWE, exploit maturity, or detailed remediation notes beyond fixed-version boundaries.
Mitigation direction
- Upgrade Jira to 7.13.7, 8.3.3, or a later supported fixed version.
- Prioritize internet-facing or partner-accessible Jira instances.
- Check Atlassian's JRASERVER-69790 advisory for any deployment-specific guidance.
- Restrict Jira access where possible until affected instances are upgraded.
Validation and detection
- Inventory Jira Server and Data Center versions across all environments.
- Confirm whether any instance runs before 7.13.7 or 8.0.0 through 8.3.2.
- Identify whether affected Jira instances are internet-facing or broadly accessible.
- Use vendor advisory mapping or authenticated scanning; avoid production payload testing.
- Document upgrade status and remaining exceptions.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2019-14996 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://jira.atlassian.com/browse/JRASERVER-69790CVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.