PT-2026-6729 · WordPress · Mattermost Confluence Plugin

Daw10 · Publicado 2026-02-06 · Atualizado 2026-03-03 · CVE-2025-13523

Positive Technologies (AI Summary)

CVSS v3.1

7.7

Alta

Vetor base

AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Mattermost Confluence plugin versions prior to 1.7.0

Description The Mattermost Confluence plugin does not properly sanitize user-controlled display names when rendering HTML templates. This allows authenticated Confluence users with malicious display names to execute arbitrary JavaScript in a victim’s browser. The issue occurs when a specially crafted OAuth2 connection link is sent and visited, rendering the attacker’s display name without proper sanitization. The vulnerable component is the HTML template rendering process. The display name is the vulnerable parameter.

Recommendations Update the Mattermost Confluence plugin to version 1.7.0 or later.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2025-13523

GHSA-FFX7-34P2-VM3W

GO-2026-4456

SUSE-SU-2026:0757-1

Produtos afetados

Mattermost Confluence Plugin

Referências · 116

• https://github.com/mattermost/mattermost-plugin-confluence · Nota
• https://mattermost.com/security-updates · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2017-18911 · Nota
• https://suse.com/security/cve/CVE-2026-20796 · Nota
• https://suse.com/security/cve/CVE-2025-64641 · Nota
• https://suse.com/security/cve/CVE-2025-14435 · Nota
• https://osv.dev/vulnerability/GO-2026-4456 · Aviso do Fabricante
• https://twitter.com/cracbot/status/2021539770577699186 · Publicação no Twitter
• https://suse.com/security/cve/CVE-2025-50180 · Nota
• https://suse.com/security/cve/CVE-2026-25518 · Nota
• https://suse.com/security/cve/CVE-2026-26190 · Nota
• https://suse.com/security/cve/CVE-2026-24135 · Nota
• https://suse.com/security/cve/CVE-2026-24122 · Nota
• https://suse.com/security/cve/CVE-2017-18918 · Nota
• https://suse.com/security/cve/CVE-2026-27590 · Nota