CVE-2025-13523: Cross-Site Scripting (XSS) via Unescaped Display Names in Mattermost Confluence Plugin OAuth2 Flow
Mattermost Confluence plugin version < 1.7.0 fails to properly escape user-controlled display names in HTML template rendering which allows authenticated Confluence users with malicious display names to execute arbitrary JavaScript in victim browsers via sending a specially crafted OAuth2 connection link that, when visited, renders the attacker's display name without proper sanitization. Mattermost Advisory ID: MMSA-2025-00557
Other sources
Mattermost Confluence plugin version <1.7.0 fails to properly escape user-controlled display names in HTML template rendering which allows authenticated Confluence users with malicious display names to execute arbitrary JavaScript in victim browsers via sending a specially crafted OAuth2 connection link that, when visited, renders the attacker's display name without proper sanitization. Mattermost Advisory ID: MMSA-2025-00557
— MITRE
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2025-13523?
CVE-2025-13523 has a moderate severity level due to its potential for Cross-Site Scripting (XSS) attacks.
How do I fix CVE-2025-13523?
You can fix CVE-2025-13523 by upgrading to Mattermost Confluence plugin version 1.7.0 or later.
Who is affected by CVE-2025-13523?
Authenticated Confluence users who utilize the Mattermost Confluence plugin version prior to 1.7.0 are affected by CVE-2025-13523.
What type of vulnerability is CVE-2025-13523?
CVE-2025-13523 is a Cross-Site Scripting (XSS) vulnerability affecting the Mattermost Confluence plugin.
Why is CVE-2025-13523 a concern?
CVE-2025-13523 is a concern because it allows attackers to execute malicious scripts in the context of authenticated user sessions.