What is the CVSS score of CVE-2025-13523?

CVE-2025-13523 has a CVSS 3.1 base score of 7.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Confluence are affected by CVE-2025-13523?

A stored cross-site scripting (XSS) vulnerability in Mattermost's Confluence plugin allows authenticated attackers to inject malicious code through specially crafted OAuth2 links, potentially…. A patch is available.

How to fix or mitigate CVE-2025-13523?

Within 24 hours: Disable the Mattermost Confluence plugin and notify users not to accept new Confluence connection requests until patched. Within 7 days: Audit user access logs for suspicious OAuth2 connection activity and monitor for any JavaScript execution anomalies. Within 30 days: Implement content security policy (CSP) headers to mitigate XSS impact, apply vendor patch immediately upon release, and conduct security awareness training on phishing/malicious link risks.

Confluence CVE-2025-13523

HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-02-06 responsibledisclosure@mattermost.com

GHSA-ffx7-34p2-vm3w

Confluence Suse

7.7

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.7 HIGH

AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N

SUSE

HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

CVE Published

Feb 06, 2026 - 16:16 nvd

HIGH 7.7

DescriptionCVE.org

Mattermost Confluence plugin version <1.7.0 fails to properly escape user-controlled display names in HTML template rendering which allows authenticated Confluence users with malicious display names to execute arbitrary JavaScript in victim browsers via sending a specially crafted OAuth2 connection link that, when visited, renders the attacker's display name without proper sanitization. Mattermost Advisory ID: MMSA-2025-00557

AnalysisAI

Technical ContextAI

Classified as CWE-79 (Cross-site Scripting (XSS)). Affects Confluence. Mattermost Confluence plugin version <1.7.0 fails to properly escape user-controlled display names in HTML template rendering which allows authenticated Confluence users with malicious display names to execute arbitrary JavaScript in victim browsers via sending a specially crafted OAuth2 connection link that, when visited, renders the attacker's display name without proper sanitization. Mattermost Advisory ID: MMSA-2025-00557

RemediationAI

Monitor vendor advisories for a patch. Implement output encoding and Content Security Policy headers. Restrict network access to the affected service where possible.

More in Confluence

View all

CVE-2015-8399 MEDIUM This Month POC

4.3 Apr 11

Atlassian Confluence before 5.8.17 allows remote authenticated users to read configuration files via the decoratorName p

CVE-2012-2926 CRITICAL Act Now POC

9.1 May 22

Atlassian JIRA before 5.0.1; Confluence before 3.5.16, 4.0 before 4.0.7, and 4.1 before 4.1.10; FishEye and Crucible bef

CVE-2016-6283 MEDIUM This Month POC

6.1 Jan 18

Cross-site scripting (XSS) vulnerability in Atlassian Confluence before 5.10.6 allows remote attackers to inject arbitra

CVE-2015-8398 MEDIUM This Month POC

6.1 Apr 11

Cross-site scripting (XSS) vulnerability in Atlassian Confluence before 5.8.17 allows remote attackers to inject arbitra

CVE-2019-3395 CRITICAL Act Now

9.8 Mar 25

The WebDAV endpoint in Atlassian Confluence Server and Data Center before version 6.6.7 (the fixed version for 6.6.x), f

CVE-2019-3394 HIGH This Week

8.8 Aug 29

There was a local file disclosure vulnerability in Confluence Server and Confluence Data Center via page exporting. Rate

CVE-2017-9505 MEDIUM This Month POC

4.3 Jun 15

Atlassian Confluence starting with 4.3.0 before 6.2.1 did not check if a user had permission to view a page when creatin

CVE-2026-21569 HIGH This Week

7.9 Jan 28

XXE injection in Atlassian Crowd Data Center and Server 7.1.0+ enables authenticated attackers to read local and remote

CVE-2019-15006 MEDIUM This Month

6.5 Dec 19

There was a man-in-the-middle (MITM) vulnerability present in the Confluence Previews plugin in Confluence Server and Co

CVE-2017-16856 MEDIUM This Month

6.1 Dec 05

The RSS Feed macro in Atlassian Confluence before version 6.5.2 allows remote attackers to inject arbitrary HTML or Java

CVE-2016-4317 MEDIUM This Month

5.4 Apr 10

Atlassian Confluence Server before 5.9.11 has XSS on the viewmyprofile.action page. Rated medium severity (CVSS 5.4), th

CVE-2020-4027 MEDIUM This Month

4.7 Jul 01

Affected versions of Atlassian Confluence Server and Data Center allowed remote attackers with system administration per

Same weakness CWE-79 – Cross-site Scripting (XSS)

View all

CVE-2013-7389 MEDIUM POC

4.3

CVE-2021-25299 MEDIUM POC

6.1

CVE-2014-2120 MEDIUM

6.1

CVE-2023-40000 HIGH POC

8.3

CVE-2016-8581 MEDIUM POC

6.1

CVE-2013-5223 MEDIUM POC

5.4

CVE-2025-52367 MEDIUM POC

5.4

CVE-2015-0072 MEDIUM POC

4.3

Vendor StatusVendor

SUSE

Severity: High

Product	Status
openSUSE Leap 15.6	Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP5	Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP6	Fixed
openSUSE Leap 15.5	Fixed

CVE-2025-13523 vulnerability details – vuln.today

Back

Confluence CVE-2025-13523

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

More in Confluence

Same weakness CWE-79 – Cross-site Scripting (XSS)

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code