CVE-2022-36801: Atlassian Jira Server and Data Center reflected XSS in TeamManagement.jspa

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityThe flaw is remotely reachable without authentication and has a very high EPSS score, though it requires victim interaction and is not in KEV.

What it is

Jira Server and Data Center before 8.20.8 contain a reflected cross-site scripting flaw in the TeamManagement.jspa endpoint. Because the endpoint is reachable anonymously, an attacker can craft a URL that executes arbitrary HTML or JavaScript in a victim's browser within the Jira origin. This matters because script execution in the Jira origin can expose session data and let an attacker act as the victim.

Impact

An attacker can run arbitrary script in the context of the Jira application, enabling theft of session or authentication data and actions performed as the logged-in user. The CVSS scope change (S:C) reflects that the impact can extend beyond the vulnerable component.

Attack surface

Reachable over the network via the TeamManagement.jspa endpoint with no authentication required (PR:N), but exploitation requires the victim to load a crafted link (UI:R). No user interaction beyond visiting the malicious URL is described.

Exploitation

Not listed in CISA KEV and no public exploit references are provided; only vendor advisories are cited. EPSS is high (0.65547, 99.2nd percentile), indicating elevated predicted exploitation likelihood despite the absence of confirmed in-the-wild activity.

What to do

• Upgrade Jira Server and Data Center to version 8.20.8 or later, which is the fixed version stated in the advisory.
• If immediate upgrade is not possible, restrict or block access to the TeamManagement.jspa endpoint where it is not needed.
• Deploy a WAF or reverse-proxy rule to detect and block script payloads targeting TeamManagement.jspa.
• Set the HttpOnly and Secure flags on session cookies to limit the value of stolen session data.
• Review anonymous access settings and disable anonymous browsing where operationally feasible.

Detection

• Search web and proxy logs for requests to TeamManagement.jspa containing script tags, event handlers, or encoded HTML/JavaScript in parameters.
• Monitor for outbound or injected script patterns and unexpected redirects tied to Jira URLs in browser or endpoint telemetry.
• Alert on anomalous authenticated actions following a user visit to a crafted Jira link, such as permission or configuration changes.
• Correlate Jira access logs with WAF alerts for repeated encoded payload attempts against the same endpoint.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.