7.7
Élevée
CVE-2025-13523 Mattermost Confluence plugin…
Description
Mattermost Confluence plugin version <1.7.0 fails to properly escape user-controlled display names in HTML template rendering which allows authenticated Confluence users with malicious display names to execute arbitrary JavaScript in victim browsers via sending a specially crafted OAuth2 connection link that, when visited, renders the attacker's display name without proper sanitization. Mattermost Advisory ID: MMSA-2025-00557
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Mattermost Confluence Plugin 1.7 | premières → < 1.7.0 | 1.7.0 |