{ "id": "CVE-2020-7760", "sourceIdentifier": "report@snyk.io", "published": "2020-10-30T11:15:12.633", "lastModified": "2024-11-21T05:37:45.027", "vulnStatus": "Modified", "cveTags": [], "descriptions": [ { "lang": "en", "value": "This affects the package codemirror before 5.58.2; the package org.apache.marmotta.webjars:codemirror before 5.58.2. The vulnerable regular expression is located in https://github.com/codemirror/CodeMirror/blob/cdb228ac736369c685865b122b736cd0d397836c/mode/javascript/javascript.jsL129. The ReDOS vulnerability of the regex is mainly due to the sub-pattern (s|/*.*?*/)*" }, { "lang": "es", "value": "Esto afecta al paquete codemirror versiones anteriores a 5.58.2; el paquete org.apache.marmotta.webjars:codemirror anterior a 5.58.2. La expresi\u00f3n regular vulnerable se encuentra en https://github.com/codemirror/CodeMirror/blob/cdb228ac736369c685865b122b736cd0d397836c/mode/javascript/javascript.jsL129. La vulnerabilidad de tipo ReDOS de la expresi\u00f3n regular se debe principalmente al subpatr\u00f3n (s|/*.*?*/)*" } ], "metrics": { "cvssMetricV31": [ { "source": "report@snyk.io", "type": "Secondary", "cvssData": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "baseScore": 5.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "LOW" }, "exploitabilityScore": 3.9, "impactScore": 1.4 }, { "source": "nvd@nist.gov", "type": "Primary", "cvssData": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH" }, "exploitabilityScore": 3.9, "impactScore": 3.6 } ], "cvssMetricV2": [ { "source": "nvd@nist.gov", "type": "Primary", "cvssData": { "version": "2.0", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "baseScore": 5.0, "accessVector": "NETWORK", "accessComplexity": "LOW", "authentication": "NONE", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "PARTIAL" }, "baseSeverity": "MEDIUM", "exploitabilityScore": 10.0, "impactScore": 2.9, "acInsufInfo": false, "obtainAllPrivilege": false, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false } ] }, "weaknesses": [ { "source": "nvd@nist.gov", "type": "Primary", "description": [ { "lang": "en", "value": "CWE-400" } ] } ], "configurations": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:a:codemirror:codemirror:*:*:*:*:*:*:*:*", "versionEndExcluding": "5.58.2", "matchCriteriaId": "CB9C8EAD-6979-4D83-AE2F-FB3836AF5F57" } ] } ] }, { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:a:oracle:application_express:*:*:*:*:*:*:*:*", "versionEndExcluding": "20.2", "matchCriteriaId": "96FC5AC6-88AC-4C4D-8692-7489D6DE8E16" }, { "vulnerable": true, "criteria": "cpe:2.3:a:oracle:enterprise_manager_express_user_interface:19c:*:*:*:*:*:*:*", "matchCriteriaId": "30CC9F81-B73C-4DE9-A781-2A1D74B8148E" }, { "vulnerable": true, "criteria": "cpe:2.3:a:oracle:essbase:21.2:*:*:*:*:*:*:*", "matchCriteriaId": "394A16F2-CCD4-44E5-BF6B-E0C782A9FA38" }, { "vulnerable": true, "criteria": "cpe:2.3:a:oracle:hyperion_data_relationship_management:*:*:*:*:*:*:*:*", "versionEndExcluding": "11.2.9.0", "matchCriteriaId": "ED431C42-980D-4E28-8036-C01A5120663F" }, { "vulnerable": true, "criteria": "cpe:2.3:a:oracle:spatial_studio:*:*:*:*:*:*:*:*", "versionEndExcluding": "19.1.0", "matchCriteriaId": "F1F23F92-E623-4A7D-879C-E5142319E6D8" } ] } ] } ], "references": [ { "url": "https://github.com/codemirror/CodeMirror/commit/55d0333907117c9231ffdf555ae8824705993bbb", "source": "report@snyk.io", "tags": [ "Patch", "Third Party Advisory" ] }, { "url": "https://snyk.io/vuln/SNYK-JAVA-ORGAPACHEMARMOTTAWEBJARS-1024450", "source": "report@snyk.io", "tags": [ "Exploit", "Third Party Advisory" ] }, { "url": "https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1024449", "source": "report@snyk.io", "tags": [ "Exploit", "Third Party Advisory" ] }, { "url": "https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1024445", "source": "report@snyk.io", "tags": [ "Exploit", "Third Party Advisory" ] }, { "url": "https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBCODEMIRROR-1024448", "source": "report@snyk.io", "tags": [ "Exploit", "Third Party Advisory" ] }, { "url": "https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBCOMPONENTS-1024446", "source": "report@snyk.io", "tags": [ "Exploit", "Third Party Advisory" ] }, { "url": "https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1024447", "source": "report@snyk.io", "tags": [ "Exploit", "Third Party Advisory" ] }, { "url": "https://snyk.io/vuln/SNYK-JS-CODEMIRROR-1016937", "source": "report@snyk.io", "tags": [ "Exploit", "Third Party Advisory" ] }, { "url": "https://www.debian.org/security/2020/dsa-4789", "source": "report@snyk.io", "tags": [ "Third Party Advisory" ] }, { "url": "https://www.oracle.com//security-alerts/cpujul2021.html", "source": "report@snyk.io", "tags": [ "Patch", "Third Party Advisory" ] }, { "url": "https://www.oracle.com/security-alerts/cpuApr2021.html", "source": "report@snyk.io", "tags": [ "Patch", "Third Party Advisory" ] }, { "url": "https://www.oracle.com/security-alerts/cpuapr2022.html", "source": "report@snyk.io", "tags": [ "Patch", "Third Party Advisory" ] }, { "url": "https://github.com/codemirror/CodeMirror/commit/55d0333907117c9231ffdf555ae8824705993bbb", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Patch", "Third Party Advisory" ] }, { "url": "https://snyk.io/vuln/SNYK-JAVA-ORGAPACHEMARMOTTAWEBJARS-1024450", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Exploit", "Third Party Advisory" ] }, { "url": "https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1024449", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Exploit", "Third Party Advisory" ] }, { "url": "https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1024445", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Exploit", "Third Party Advisory" ] }, { "url": "https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBCODEMIRROR-1024448", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Exploit", "Third Party Advisory" ] }, { "url": "https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBCOMPONENTS-1024446", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Exploit", "Third Party Advisory" ] }, { "url": "https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1024447", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Exploit", "Third Party Advisory" ] }, { "url": "https://snyk.io/vuln/SNYK-JS-CODEMIRROR-1016937", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Exploit", "Third Party Advisory" ] }, { "url": "https://www.debian.org/security/2020/dsa-4789", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Third Party Advisory" ] }, { "url": "https://www.oracle.com//security-alerts/cpujul2021.html", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Patch", "Third Party Advisory" ] }, { "url": "https://www.oracle.com/security-alerts/cpuApr2021.html", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Patch", "Third Party Advisory" ] }, { "url": "https://www.oracle.com/security-alerts/cpuapr2022.html", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Patch", "Third Party Advisory" ] } ] }