Security readout for executives and security teams
Plain-English summary
CVE-2022-36131 is a stored cross-site scripting issue in Better PDF Exporter add-on 10.0.0 for Atlassian Jira. A malicious description can be saved and later rendered on the PDF Templates overview page. Business urgency depends on whether this Jira add-on and version are present.
Executive priority
Prioritize verification where Jira supports sensitive workflows or external users can influence template content. Without confirmed installation, active exploitation, or a named severity score, treat this as a targeted exposure check rather than a broad emergency.
Technical view
The CVE description identifies stored XSS via a crafted description reaching the PDF Templates overview page in Better PDF Exporter for Jira 10.0.0. The provided sources do not include CVSS, CWE, patch version, exploit maturity, or detailed privilege requirements.
Likely exposure
Exposure is likely limited to Jira environments running Better PDF Exporter add-on 10.0.0. The source bundle does not identify cloud, server, or data center scope beyond the referenced Atlassian Marketplace server listing.
Exploitation context
The CVE is not listed as KEV in the bundle, and no provided source states active exploitation. Stored XSS generally matters when attackers can create or modify the affected stored field and a victim views the vulnerable page.
Researcher notes
Evidence is sparse. The CVE record names Better PDF Exporter for Jira 10.0.0 and the vulnerable page, but the bundle lacks scoring, affected CPEs, exploit status, fixed release details, and preconditions. Avoid expanding scope beyond the named add-on/version.
Mitigation direction
- Inventory Jira instances for Better PDF Exporter for Jira.
- Confirm whether version 10.0.0 is installed.
- Check vendor and Atlassian Marketplace guidance for fixed versions.
- Restrict access to PDF template administration until remediated.
- Review recent template description changes for suspicious content.
Validation and detection
- Verify installed add-on name and exact version in Jira.
- Identify users able to edit PDF template descriptions.
- Review PDF Templates overview rendering for unsafe stored content.
- Check logs or audit records for unexpected template description edits.
- Track vendor advisory status before closing the finding.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2022-36131 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://marketplace.atlassian.com/apps/5167/better-pdf-exporter-for-jira?tab=overview&hosting=serverCVE reference · x_refsource_MISC
- https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2022-038.txtCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.