CVE-2020-7760— Regular Expression Denial of Service (ReDoS)
Quick assessment
Affected
n/a codemirror
Exploitation
High exploitation probability; assess promptly
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
CodeMirror是CodeMirror（Codemirror）团队的一个使用JavaScript为浏览器实现的多功能文本编辑器。该软件专门用于编辑代码，并具有100多种语言模式和各种插件，可实现更高级的编辑功能，每种语言都带有功能齐全的代码和语法高亮显示，以帮助阅读和编辑复杂代码。 codemirror 5.58.2 之前版本和org.apache.marmotta.webjars:codemirror 5.58.2 之前版本存在资源管理错误漏洞。该漏洞源于blob/cdb228ac736369c68
Possible ATT&CK Techniques 1 AI
T1496 · Resource Hijacking
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2020-7760
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Regular Expression Denial of Service (ReDoS)
Source: CVE Program / CVE List V5
Vulnerability Description
This affects the package codemirror before 5.58.2; the package org.apache.marmotta.webjars:codemirror before 5.58.2. The vulnerable regular expression is located in https://github.com/codemirror/CodeMirror/blob/cdb228ac736369c685865b122b736cd0d397836c/mode/javascript/javascript.jsL129. The ReDOS vulnerability of the regex is mainly due to the sub-pattern (s|/*.*?*/)*
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
CodeMirror 资源管理错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
CodeMirror是CodeMirror（Codemirror）团队的一个使用JavaScript为浏览器实现的多功能文本编辑器。该软件专门用于编辑代码，并具有100多种语言模式和各种插件，可实现更高级的编辑功能，每种语言都带有功能齐全的代码和语法高亮显示，以帮助阅读和编辑复杂代码。 codemirror 5.58.2 之前版本和org.apache.marmotta.webjars:codemirror 5.58.2 之前版本存在资源管理错误漏洞。该漏洞源于blob/cdb228ac736369c68
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| - | codemirror | unspecified ~ 5.58.2 | - |
|
| - | org.apache.marmotta.webjars:codemirror | unspecified ~ 5.58.2 | - |
|
II. Public POCs for CVE-2020-7760
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2020-7760
请登录查看更多情报信息。
Patches & Fixes for CVE-2020-7760 (1)
Vendor Advisories for CVE-2020-7760 (9)
-
https://www.oracle.com/security-alerts/cpuApr2021.html x_refsource_MISC
-
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1024447 x_refsource_MISC
-
https://www.oracle.com//security-alerts/cpujul2021.html x_refsource_MISC
-
https://snyk.io/vuln/SNYK-JS-CODEMIRROR-1016937 x_refsource_MISC
-
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1024449 x_refsource_MISC
-
https://snyk.io/vuln/SNYK-JAVA-ORGAPACHEMARMOTTAWEBJARS-1024450 x_refsource_MISC
-
https://www.oracle.com/security-alerts/cpuapr2022.html x_refsource_MISC
-
Same Patch Batch · n/a · 2020-10-30 · 12 CVEs total
| CVE-2020-7759 | 6.5 MEDIUM | SQL Injection |
| CVE-2020-28031 | Eramba 注入漏洞 | |
| CVE-2020-28030 | Wireshark 资源管理错误漏洞 | |
| CVE-2020-8183 | Nextcloud 安全漏洞 | |
| CVE-2020-8173 | Nextcloud 加密问题漏洞 | |
| CVE-2020-8236 | Nextcloud 授权问题漏洞 | |
| CVE-2020-7373 | vBulletin 命令注入漏洞 | |
| CVE-2020-15914 | Electronic Arts Inc Electronic Arts Origin Client 跨站脚本漏洞 | |
| CVE-2020-27708 | Electronic Arts Inc Electronic Arts Origin Client 安全漏洞 | |
| CVE-2020-6014 | Check Point Endpoint Security Client 代码问题漏洞 | |
| CVE-2020-28002 | SonarSource SonarQube 授权问题漏洞 |
IV. Related Vulnerabilities
V. Comments for CVE-2020-7760
No comments yet