En resumen
- CVE-2025-13523 es una vulnerabilidad MEDIO (CVSS 5.4) que afecta a github.com/mattermost/mattermost-plugin-confluence, confluence (mattermost).
- Probabilidad de explotación en los próximos 30 días (EPSS): 0.22%, mayor que el 12.1% de las vulnerabilidades.
- Solución: actualizar a 1.7.0 o posterior.
Description
Mattermost Confluence plugin version < 1.7.0 fails to properly escape user-controlled display names in HTML template rendering which allows authenticated Confluence users with malicious display names to execute arbitrary JavaScript in victim browsers via sending a specially crafted OAuth2 connection link that, when visited, renders the attacker's display name without proper sanitization. Mattermost Advisory ID: MMSA-2025-00557
NVD description
Mattermost Confluence plugin version <1.7.0 fails to properly escape user-controlled display names in HTML template rendering which allows authenticated Confluence users with malicious display names to execute arbitrary JavaScript in victim browsers via sending a specially crafted OAuth2 connection link that, when visited, renders the attacker's display name without proper sanitization. Mattermost Advisory ID: MMSA-2025-00557
Más vulnerabilidades de github.com/mattermost/mattermost-plugin-confluence
Ver todo →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free