Medium severity · published Feb 15, 2021
CVE-2020-28500
Regular Expression Denial of Service (ReDoS)
5.3
CVSS
7.3%
EPSS
No
On KEV
Description
Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)7.3% · higher than 94% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LO
Lodash ·
versions prior to 4.17.21 · source: vendor, NVD
BC
Banking Corporate Lending Process Management · Oracle
14.2.0; 14.3.0; 14.5.0 · source: NVD
BC
Banking Credit Facilities Process Management · Oracle
14.2.0; 14.3.0; 14.5.0 · source: NVD
BE
Banking Extensibility Workbench · Oracle
14.2.0; 14.3.0; 14.5.0 · source: NVD
BS
Banking Supply Chain Finance · Oracle
14.2.0; 14.3.0; 14.5.0 · source: NVD
BT
Banking Trade Finance Process Management · Oracle
14.2.0; 14.3.0; 14.5.0 · source: NVD
CC
Communications Cloud Native Core Policy · Oracle
1.11.0 · source: NVD
CD
Communications Design Studio · Oracle
7.4.2 · source: NVD
CS
Communications Services Gatekeeper · Oracle
7.0 · source: NVD
CS
Communications Session Border Controller · Oracle
8.4; 9.0 · source: NVD
EC
Enterprise Communications Broker · Oracle
3.2.0; 3.3.0 · source: NVD
FS
Financial Services Crime And Compliance Management Studio · Oracle
8.0.8.2.0; 8.0.8.3.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-28500
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-28500
Patch
https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf
Broken Link
https://github.com/lodash/lodash/blob/npm/trimEnd.js%23L8
Patch
https://github.com/lodash/lodash/pull/5065
Third Party Advisory
https://security.netapp.com/advisory/ntap-20210312-0006/
Exploit
https://snyk.io/vuln/SNYK-JAVA-ORGFUJIONWEBJARS-1074896
Exploit
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1074894
More from Lodash
7.2
CVE-2021-23337
Command Injection