A high-severity Cross-site Scripting vulnerability in the Mattermost Confluence plugin allows authenticated users to execute arbitrary JavaScript in the browsers of other users.

The vulnerability is a Stored Cross-site Scripting flaw (CWE-79) caused by improper neutralization of user-controlled display names. An authenticated user can trigger this by crafting a malicious display name, which is then rendered in the browser of a victim who visits a malicious OAuth2 connection link.

Successful exploitation allows an attacker to execute arbitrary JavaScript within the context of a victim's session, potentially leading to unauthorized actions, session hijacking, or sensitive data theft. With a CVSS score of 7.7, this vulnerability poses a significant risk to organizational data integrity and user account security, particularly within collaborative environments where trust is high.

Immediate Action: Update the Mattermost Confluence plugin to version 1.7.0 or higher immediately to apply the necessary input sanitization patches.

Proactive Monitoring: Review web application logs for suspicious OAuth2 traffic patterns or unusual display name strings that contain script tags or unexpected HTML characters.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured to inspect and block malicious payloads in HTTP requests, which may provide temporary protection against XSS injection attempts.

Public Exploit Available: No confirmed public exploit (exploit_available: false).

Given the potential for account compromise and the ability for an attacker to target other users via OAuth2 links, organizations should prioritize updating the Mattermost Confluence plugin to version 1.7.0. Administrators must ensure that all instances are patched to eliminate this XSS vector and protect user sessions from unauthorized script execution.