Security readout for executives and security teams
Plain-English summary
This CVE is a cross-site scripting issue in Atlassian Jira Server and Data Center. An attacker could inject HTML or JavaScript through Issue Navigator Basic Search. The supplied sources do not provide CVSS scoring or active exploitation evidence, but exposed or broadly used Jira instances should be prioritized because Jira often holds sensitive operational data.
Executive priority
Prioritize remediation for internet-facing or widely accessible Jira systems. The absence of CVSS and KEV evidence lowers certainty, but Jira’s business sensitivity makes unpatched XSS a meaningful governance and data-risk concern.
Technical view
Affected Jira Server and Data Center versions before 7.13.9, and 8.0.0 before 8.4.2, allow remote HTML or JavaScript injection in Issue Navigator Basic Search. The source bundle does not state authentication requirements, payload conditions, CVSS metrics, or exploitation in the wild.
Likely exposure
Exposure is likely limited to organizations running Jira Server or Data Center versions below the listed fixed releases. Risk increases where Jira is internet-facing, reachable by many users, or contains sensitive issue data. The supplied evidence does not confirm whether anonymous access is required or sufficient.
Exploitation context
The CVE record describes remote attacker injection of arbitrary HTML or JavaScript. It is not listed as CISA KEV in the supplied bundle, and no cited source states active exploitation. Treat exploitation status as unconfirmed.
Researcher notes
Evidence is sparse. The provided sources identify the vulnerable component and fixed version boundaries, but omit CVSS, CWE, authentication prerequisites, exploit maturity, and detailed remediation notes beyond affected-version ranges.
Mitigation direction
- Upgrade affected Jira Server/Data Center instances to 7.13.9, 8.4.2, or later supported versions.
- Review Atlassian JRASERVER-70885 for vendor-specific fix and advisory details.
- Restrict Jira access to trusted users and networks where operationally feasible.
- Increase monitoring for suspicious Jira browser-side behavior until remediation is complete.
Validation and detection
- Inventory all Jira Server and Data Center deployments and record exact versions.
- Compare deployed versions against before 7.13.9 and 8.0.0 before 8.4.2.
- Confirm whether Issue Navigator Basic Search is reachable by untrusted users.
- Review Jira logs and user reports for suspicious search-page behavior.
- Verify the upgrade or vendor-recommended remediation is applied in production.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2019-20414 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://jira.atlassian.com/browse/JRASERVER-70885CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.