PT-2020-17258 · Keysight+1 · Keysight Database Connector+1

Published 2020-12-15 · Updated 2021-07-21 · CVE-2020-35121

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Keysight Database Connector plugin versions prior to 1.5.0 for Confluence

Description An issue was discovered in the Keysight Database Connector plugin for Confluence, where a malicious user could insert arbitrary JavaScript into saved macro parameters. This JavaScript would execute when a user viewed a page with that instance of the macro.

Recommendations For versions prior to 1.5.0, update to version 1.5.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the macro parameters to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2020-35121

Affected Products

Confluence

Keysight Database Connector

References · 6

• https://osv.dev/vulnerability/CVE-2020-35121 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-35121 · Security Note
• https://t.me/cvenotify/7216 · Telegram Post
• https://t.me/cvenotify/7357 · Telegram Post
• https://bitbucket.org/keysight/keysight-plugins-for-atlassian-products/wiki/Confluence%20Plugins/Database%20Plugin · Note
• https://t.me/cibsecurity/20896 · Telegram Post