{ "id": "CVE-2020-28500", "sourceIdentifier": "report@snyk.io", "published": "2021-02-15T11:15:12.397", "lastModified": "2022-09-13T21:18:50.543", "vulnStatus": "Analyzed", "descriptions": [ { "lang": "en", "value": "Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions." }, { "lang": "es", "value": "Las versiones de Lodash anteriores a la 4.17.21 son vulnerables a la denegaci\u00f3n de servicio por expresiones regulares (ReDoS) a trav\u00e9s de las funciones toNumber, trim y trimEnd" } ], "metrics": { "cvssMetricV31": [ { "source": "nvd@nist.gov", "type": "Primary", "cvssData": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM" }, "exploitabilityScore": 3.9, "impactScore": 1.4 }, { "source": "report@snyk.io", "type": "Secondary", "cvssData": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM" }, "exploitabilityScore": 3.9, "impactScore": 1.4 } ], "cvssMetricV2": [ { "source": "nvd@nist.gov", "type": "Primary", "cvssData": { "version": "2.0", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "accessVector": "NETWORK", "accessComplexity": "LOW", "authentication": "NONE", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 5.0 }, "baseSeverity": "MEDIUM", "exploitabilityScore": 10.0, "impactScore": 2.9, "acInsufInfo": false, "obtainAllPrivilege": false, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false } ] }, "weaknesses": [ { "source": "nvd@nist.gov", "type": "Primary", "description": [ { "lang": "en", "value": "NVD-CWE-Other" } ] } ], "configurations": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:a:lodash:lodash:*:*:*:*:*:node.js:*:*", "versionEndExcluding": "4.17.21", "matchCriteriaId": "D51E96E4-8E0F-4B1D-ACAD-DB726036467F" } ] } ] }, { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.2.0:*:*:*:*:*:*:*", "matchCriteriaId": "0CF9A061-2421-426D-9854-0A4E55B2961D" }, { "vulnerable": true, "criteria": "cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.3.0:*:*:*:*:*:*:*", "matchCriteriaId": "F95EDC3D-54BB-48F9-82F2-7CCF335FCA78" }, { "vulnerable": true, "criteria": "cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.5.0:*:*:*:*:*:*:*", "matchCriteriaId": "B72B735F-4E52-484A-9C2C-23E6E2070385" }, { "vulnerable": true, "criteria": "cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.2.0:*:*:*:*:*:*:*", "matchCriteriaId": "8B36A1D4-F391-4EE3-9A65-0A10568795BA" }, { "vulnerable": true, "criteria": "cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.3.0:*:*:*:*:*:*:*", "matchCriteriaId": "55116032-AAD1-4FEA-9DA8-2C4CBD3D3F61" }, { "vulnerable": true, "criteria": "cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.5.0:*:*:*:*:*:*:*", "matchCriteriaId": "0275F820-40BE-47B8-B167-815A55DF578E" }, { "vulnerable": true, "criteria": "cpe:2.3:a:oracle:banking_extensibility_workbench:14.2.0:*:*:*:*:*:*:*", "matchCriteriaId": "8C8E145E-1DF0-4B18-B625-F04DF71F6ACF" }, { "vulnerable": true, "criteria": "cpe:2.3:a:oracle:banking_extensibility_workbench:14.3.0:*:*:*:*:*:*:*", "matchCriteriaId": "EABAFD73-150F-4DFE-B721-29EB4475D979" }, { "vulnerable": true, "criteria": "cpe:2.3:a:oracle:banking_extensibility_workbench:14.5.0:*:*:*:*:*:*:*", "matchCriteriaId": "8A45D47B-3401-49CF-92EE-79D007D802A9" }, { "vulnerable": true, "criteria": "cpe:2.3:a:oracle:banking_supply_chain_finance:14.2.0:*:*:*:*:*:*:*", "matchCriteriaId": "6A8420D4-AAF1-44AA-BF28-48EE3ED310B9" }, { "vulnerable": true, "criteria": "cpe:2.3:a:oracle:banking_supply_chain_finance:14.3.0:*:*:*:*:*:*:*", "matchCriteriaId": "2FB80AC5-35F2-4703-AD93-416B46972EEB" }, { "vulnerable": true, "criteria": "cpe:2.3:a:oracle:banking_supply_chain_finance:14.5.0:*:*:*:*:*:*:*", "matchCriteriaId": "19DAAEFF-AB4A-4D0D-8C86-D2F2811B53B1" }, { "vulnerable": true, "criteria": "cpe:2.3:a:oracle:banking_trade_finance_process_management:14.2.0:*:*:*:*:*:*:*", "matchCriteriaId": "9E14324D-B9EE-4C06-ACC7-255189ED6300" }, { "vulnerable": true, "criteria": "cpe:2.3:a:oracle:banking_trade_finance_process_management:14.3.0:*:*:*:*:*:*:*", "matchCriteriaId": "CBEBB60F-6EAB-4AE5-B777-5044C657FBA8" }, { "vulnerable": true, "criteria": "cpe:2.3:a:oracle:banking_trade_finance_process_management:14.5.0:*:*:*:*:*:*:*", "matchCriteriaId": "B185C1EA-71E6-4972-8637-08A33CC00841" }, { "vulnerable": true, "criteria": "cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.11.0:*:*:*:*:*:*:*", "matchCriteriaId": "EC7DB86F-3FAA-43C1-9C44-7CC5FB34419E" }, { "vulnerable": true, "criteria": "cpe:2.3:a:oracle:communications_design_studio:7.4.2:*:*:*:*:*:*:*", "matchCriteriaId": "A67AA54B-258D-4D09-9ACB-4085E0B3E585" }, { "vulnerable": true, "criteria": "cpe:2.3:a:oracle:communications_services_gatekeeper:7.0:*:*:*:*:*:*:*", "matchCriteriaId": "062E4E7C-55BB-46F3-8B61-5A663B565891" }, { "vulnerable": true, "criteria": "cpe:2.3:a:oracle:communications_session_border_controller:8.4:*:*:*:*:*:*:*", "matchCriteriaId": "9C416FD3-2E2F-4BBC-BD5F-F896825883F4" }, { "vulnerable": true, "criteria": "cpe:2.3:a:oracle:communications_session_border_controller:9.0:*:*:*:*:*:*:*", "matchCriteriaId": "D886339E-EDB2-4879-BD54-1800E4CA9CAE" }, { "vulnerable": true, "criteria": "cpe:2.3:a:oracle:enterprise_communications_broker:3.2.0:*:*:*:*:*:*:*", "matchCriteriaId": "348EEE70-E114-4720-AAAF-E77DE5C9A2D1" }, { "vulnerable": true, "criteria": "cpe:2.3:a:oracle:enterprise_communications_broker:3.3.0:*:*:*:*:*:*:*", "matchCriteriaId": "3DCDD73B-57B1-4580-B922-5662E3AC13B6" }, { "vulnerable": true, "criteria": "cpe:2.3:a:oracle:financial_services_crime_and_compliance_management_studio:8.0.8.2.0:*:*:*:*:*:*:*", "matchCriteriaId": "55F091C7-0869-4FD6-AC73-DA697D990304" }, { "vulnerable": true, "criteria": "cpe:2.3:a:oracle:financial_services_crime_and_compliance_management_studio:8.0.8.3.0:*:*:*:*:*:*:*", "matchCriteriaId": "4D134C60-F9E2-46C2-8466-DB90AD98439E" }, { "vulnerable": true, "criteria": "cpe:2.3:a:oracle:health_sciences_data_management_workbench:2.5.2.1:*:*:*:*:*:*:*", "matchCriteriaId": "E6C9A32B-B776-4704-818D-977B4B20D677" }, { "vulnerable": true, "criteria": "cpe:2.3:a:oracle:health_sciences_data_management_workbench:3.0.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "6989178B-A3D5-4441-A56C-6C639D4759DF" }, { "vulnerable": true, "criteria": "cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:*", "versionEndExcluding": "9.2.6.1", "matchCriteriaId": "D1298AA2-0103-4457-B260-F976B78468E7" }, { "vulnerable": true, "criteria": "cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:*", "matchCriteriaId": "D9DB4A14-2EF5-4B54-95D2-75E6CF9AA0A9" }, { "vulnerable": true, "criteria": "cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:*", "matchCriteriaId": "C8AF00C6-B97F-414D-A8DF-057E6BFD8597" }, { "vulnerable": true, "criteria": "cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:*", "versionStartIncluding": "17.12.0", "versionEndIncluding": "17.12.11", "matchCriteriaId": "8B1C88FD-C2EC-4C96-AC7E-6F95C8763B48" }, { "vulnerable": true, "criteria": "cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:*", "versionStartIncluding": "18.8.0", "versionEndIncluding": "18.8.12", "matchCriteriaId": "301E7158-9090-467C-B3B4-30A8DB3B395D" }, { "vulnerable": true, "criteria": "cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:*", "versionStartIncluding": "19.12.0", "versionEndIncluding": "19.12.11", "matchCriteriaId": "BBEFACB1-C8EA-492B-8F85-A564DB363C83" }, { "vulnerable": true, "criteria": "cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:*", "versionStartIncluding": "20.12.0", "versionEndIncluding": "20.12.7", "matchCriteriaId": "E6B70E72-B9FC-4E49-8EDD-29C7E14F5792" }, { "vulnerable": true, "criteria": "cpe:2.3:a:oracle:primavera_unifier:*:*:*:*:*:*:*:*", "versionStartIncluding": "17.7", "versionEndIncluding": "17.12", "matchCriteriaId": "08FA59A8-6A62-4B33-8952-D6E658F8DAC9" }, { "vulnerable": true, "criteria": "cpe:2.3:a:oracle:primavera_unifier:18.8:*:*:*:*:*:*:*", "matchCriteriaId": "202AD518-2E9B-4062-B063-9858AE1F9CE2" }, { "vulnerable": true, "criteria": "cpe:2.3:a:oracle:primavera_unifier:19.12:*:*:*:*:*:*:*", "matchCriteriaId": "10864586-270E-4ACF-BDCC-ECFCD299305F" }, { "vulnerable": true, "criteria": "cpe:2.3:a:oracle:primavera_unifier:20.12:*:*:*:*:*:*:*", "matchCriteriaId": "38340E3C-C452-4370-86D4-355B6B4E0A06" }, { "vulnerable": true, "criteria": "cpe:2.3:a:oracle:retail_customer_management_and_segmentation_foundation:19.0:*:*:*:*:*:*:*", "matchCriteriaId": "9EFAEA84-E376-40A2-8C9F-3E0676FEC527" } ] } ] }, { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:a:siemens:sinec_ins:*:*:*:*:*:*:*:*", "versionEndExcluding": "1.0", "matchCriteriaId": "C89891C1-DFD7-4E1F-80A9-7485D86A15B5" }, { "vulnerable": true, "criteria": "cpe:2.3:a:siemens:sinec_ins:1.0:-:*:*:*:*:*:*", "matchCriteriaId": "4664B195-AF14-4834-82B3-0B2C98020EB6" }, { "vulnerable": true, "criteria": "cpe:2.3:a:siemens:sinec_ins:1.0:sp1:*:*:*:*:*:*", "matchCriteriaId": "75BC588E-CDF0-404E-AD61-02093A1DF343" } ] } ] } ], "references": [ { "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf", "source": "report@snyk.io", "tags": [ "Patch", "Third Party Advisory" ] }, { "url": "https://github.com/lodash/lodash/pull/5065", "source": "report@snyk.io", "tags": [ "Patch", "Third Party Advisory" ] }, { "url": "https://security.netapp.com/advisory/ntap-20210312-0006/", "source": "report@snyk.io", "tags": [ "Third Party Advisory" ] }, { "url": "https://snyk.io/vuln/SNYK-JAVA-ORGFUJIONWEBJARS-1074896", "source": "report@snyk.io", "tags": [ "Exploit", "Third Party Advisory" ] }, { "url": "https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1074894", "source": "report@snyk.io", "tags": [ "Exploit", "Third Party Advisory" ] }, { "url": "https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1074892", "source": "report@snyk.io", "tags": [ "Exploit", "Third Party Advisory" ] }, { "url": "https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBLODASH-1074895", "source": "report@snyk.io", "tags": [ "Exploit", "Third Party Advisory" ] }, { "url": "https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1074893", "source": "report@snyk.io", "tags": [ "Exploit", "Third Party Advisory" ] }, { "url": "https://snyk.io/vuln/SNYK-JS-LODASH-1018905", "source": "report@snyk.io", "tags": [ "Exploit", "Third Party Advisory" ] }, { "url": "https://www.oracle.com//security-alerts/cpujul2021.html", "source": "report@snyk.io", "tags": [ "Not Applicable", "Third Party Advisory" ] }, { "url": "https://www.oracle.com/security-alerts/cpujan2022.html", "source": "report@snyk.io", "tags": [ "Patch", "Third Party Advisory" ] }, { "url": "https://www.oracle.com/security-alerts/cpujul2022.html", "source": "report@snyk.io", "tags": [ "Patch", "Third Party Advisory" ] }, { "url": "https://www.oracle.com/security-alerts/cpuoct2021.html", "source": "report@snyk.io", "tags": [ "Patch", "Third Party Advisory" ] } ] }