CVE-2020-28469

Published: Jun 3, 2021Modified: Nov 21, 2024

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

This affects the package glob-parent before 5.1.2. The enclosure regex used to check for strings ending in enclosure containing path separator.

Affected (2)

Products: Gulpjs: Glob Parent · Oracle: Communications Cloud Native Core Policy

Gulpjs

1 product

Glob Parent

Oracle

1 product

Communications Cloud Native Core Policy

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Gulpjs Glob Parent	Before 5.1.2

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Oracle Communications Cloud Native Core Policy	Version 1.14.0

Related CWEs

CWE-400

Uncontrolled Resource Consumption

The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.

References (14)

https://github.com/gulpjs/glob-parent/blob/6ce8d11f2f1ed8e80a9526b1dc8cf3aa71f43474/index.js%23L9

Source: report@snyk.io

Broken Link

https://github.com/gulpjs/glob-parent/pull/36

Source: report@snyk.io

PatchThird Party Advisory

https://github.com/gulpjs/glob-parent/releases/tag/v5.1.2

Source: report@snyk.io

Release NotesThird Party Advisory

https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBES128-1059093

Source: report@snyk.io

ExploitThird Party Advisory

https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1059092

Source: report@snyk.io

ExploitThird Party Advisory

https://snyk.io/vuln/SNYK-JS-GLOBPARENT-1016905

Source: report@snyk.io

ExploitThird Party Advisory

https://www.oracle.com/security-alerts/cpujan2022.html

Source: report@snyk.io

PatchThird Party Advisory

https://github.com/gulpjs/glob-parent/blob/6ce8d11f2f1ed8e80a9526b1dc8cf3aa71f43474/index.js%23L9