Regular Expression Denial of Service (ReDoS)
CVE-2020-7760

5.3MEDIUM

Key Information:

Vendor

Codemirror

Status
Codemirror
Org.apache.marmotta.webjars:codemirror
Vendor
CVE Published:
30 October 2020

What is CVE-2020-7760?

This affects the package codemirror before 5.58.2; the package org.apache.marmotta.webjars:codemirror before 5.58.2. The vulnerable regular expression is located in https://github.com/codemirror/CodeMirror/blob/cdb228ac736369c685865b122b736cd0d397836c/mode/javascript/javascript.jsL129. The ReDOS vulnerability of the regex is mainly due to the sub-pattern (s|/.?/)

Affected Version(s)

codemirror < 5.58.2

org.apache.marmotta.webjars:codemirror < 5.58.2

References

https://snyk.io/vuln/SNYK-JS-CODEMIRROR-1016937
x_refsource_MISC
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1024445
x_refsource_MISC
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBCOMPO...
x_refsource_MISC

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Yeting Li
.