{"id":"CVE-2022-36801","published":"2022-08-10T02:20:09Z","modified":"2024-10-29T15:15:10Z","title":"Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to inject arbitrary HTML…","vendor":"Atlassian","product":"Jira Server","tier":"core","eol":null,"affectedVersions":[{"vendor":"Atlassian","product":"Jira Server","versions":[">= unspecified, < 8.20.8"]},{"vendor":"Atlassian","product":"Jira Data Center","versions":[">= unspecified, < 8.20.8"]}],"description":{"text":"Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to inject arbitrary HTML or JavaScript via a Reflected Cross-Site Scripting (RXSS) vulnerability in the TeamManagement.jspa endpoint. The affected versions are before version 8.20.8.","provenance":"source","from":"CVE.org"},"summary":{"text":"A reflected cross-site scripting flaw in the TeamManagement.jspa endpoint of Atlassian Jira Server and Data Center allows arbitrary HTML or JavaScript injection in affected versions prior to 8.20.8. An unauthenticated remote attacker can exploit it over the network, but only if a user is induced to interact with a crafted link or request.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:22:29Z"},"cvss":{"score":6.1,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","provenance":"source","from":"CISA ADP Vulnrichment"},"epss":{"score":0.67091,"percentile":0.99298,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation"}],"references":[{"url":"https://jira.atlassian.com/browse/JRASERVER-73740","tags":["x_refsource_MISC"]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2022-39501","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-39501","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2022-08-10","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2022-36801","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":24.1,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.86,"detail":"percentile 0.9930"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":4.27,"detail":"base score 6.1"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}