Lucene search

[email protected]CVE-2020-28500

HistoryFeb 15, 2021 - 11:15 a.m.

CVE-2020-28500

2021-02-1511:15:00

NVD-CWE-Other

[email protected]

web.nvd.nist.gov

161

lodash

cve-2020-28500

redos

nvd

regular expression denial of service

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

6 Medium

AI Score

Confidence

High

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.002 Low

EPSS

Percentile

60.9%

JSON

Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.

CPENameOperatorVersion
lodash:lodashlodashlt4.17.21
oracle:primavera_unifieroracle primavera unifiereq18.8
oracle:primavera_unifieroracle primavera unifierle17.12
oracle:peoplesoft_enterprise_peopletoolsoracle peoplesoft enterprise peopletoolseq8.58
oracle:primavera_unifieroracle primavera unifiereq19.12
oracle:retail_customer_management_and_segmentation_foundationoracle retail customer management and segmentation foundationeq19.0
oracle:communications_services_gatekeeperoracle communications services gatekeepereq7.0
oracle:enterprise_communications_brokeroracle enterprise communications brokereq3.2.0
oracle:primavera_unifieroracle primavera unifiereq20.12
oracle:banking_extensibility_workbenchoracle banking extensibility workbencheq14.3.0

CPE	Name	Operator	Version
lodash:lodash	lodash	lt	4.17.21
oracle:primavera_unifier	oracle primavera unifier	eq	18.8
oracle:primavera_unifier	oracle primavera unifier	le	17.12
oracle:peoplesoft_enterprise_peopletools	oracle peoplesoft enterprise peopletools	eq	8.58
oracle:primavera_unifier	oracle primavera unifier	eq	19.12
oracle:retail_customer_management_and_segmentation_foundation	oracle retail customer management and segmentation foundation	eq	19.0
oracle:communications_services_gatekeeper	oracle communications services gatekeeper	eq	7.0
oracle:enterprise_communications_broker	oracle enterprise communications broker	eq	3.2.0
oracle:primavera_unifier	oracle primavera unifier	eq	20.12
oracle:banking_extensibility_workbench	oracle banking extensibility workbench	eq	14.3.0