CVE-2020-7760: This affects the package codemirror before 5.58.2; the package org.apache.marmotta.webjars:codemirror before 5.58.2

Description

This affects the package codemirror before 5.58.2; the package org.apache.marmotta.webjars:codemirror before 5.58.2. The vulnerable regular expression is located in https://github.com/codemirror/CodeMirror/blob/cdb228ac736369c685865b122b736cd0d397836c/mode/javascript/javascript.jsL129. The ReDOS vulnerability of the regex is mainly due to the sub-pattern (s|/*.*?*/)*

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

None

Confidentiality

None

Integrity

None

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)5.3% · higher than 93% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

AE

Application Express · Oracle

before 20.2 · source: NVD

CO

Codemirror · Codemirror

before 5.58.2 · source: NVD

EM

Enterprise Manager Express User Interface · Oracle

19c · source: NVD

ES

Essbase · Oracle

21.2 · source: NVD

HD

Hyperion Data Relationship Management · Oracle

before 11.2.9.0 · source: NVD

SS

Spatial Studio · Oracle

before 19.1.0 · source: NVD