[email protected]CVE-2020-7760

HistoryOct 30, 2020 - 11:15 a.m.

CVE-2020-7760

2020-10-3011:15:00

CWE-400

[email protected]

web.nvd.nist.gov

104

cve-2020-7760

codemirror

redos

regex

security vulnerability

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

6 Medium

AI Score

Confidence

High

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.015 Low

EPSS

Percentile

86.6%

JSON

This affects the package codemirror before 5.58.2; the package org.apache.marmotta.webjars:codemirror before 5.58.2. The vulnerable regular expression is located in https://github.com/codemirror/CodeMirror/blob/cdb228ac736369c685865b122b736cd0d397836c/mode/javascript/javascript.jsL129. The ReDOS vulnerability of the regex is mainly due to the sub-pattern (s|/.?/)

CPENameOperatorVersion
codemirror:codemirrorcodemirrorlt5.58.2
oracle:application_expressoracle application expresslt20.2
oracle:essbaseoracle essbaseeq21.2
oracle:enterprise_manager_express_user_interfaceoracle enterprise manager express user interfaceeq19c
oracle:hyperion_data_relationship_managementoracle hyperion data relationship managementlt11.2.9.0
oracle:spatial_studiooracle spatial studiolt19.1.0

CPE	Name	Operator	Version
codemirror:codemirror	codemirror	lt	5.58.2
oracle:application_express	oracle application express	lt	20.2
oracle:essbase	oracle essbase	eq	21.2
oracle:enterprise_manager_express_user_interface	oracle enterprise manager express user interface	eq	19c
oracle:hyperion_data_relationship_management	oracle hyperion data relationship management	lt	11.2.9.0
oracle:spatial_studio	oracle spatial studio	lt	19.1.0