CVE-2020-28500

Published: Feb 15, 2021Modified: Jun 17, 2026

5.3

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Exploitability: 3.9 / Impact: 1.4

Source: NVD

Description

Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.

Affected (42)

Products: Lodash: Lodash · Oracle: Banking Corporate Lending Process Management, Banking Credit Facilities Process Management, Banking Extensibility Workbench, Banking Supply Chain Finance, Banking Trade Finance Process Management, Communications Cloud Native Core Policy, Communications Design Studio, Communications Services Gatekeeper, Communications Session Border Controller, Enterprise Communications Broker, Financial Services Crime And Compliance Management Studio, Health Sciences Data Management Workbench, Jd Edwards Enterpriseone Tools, Peoplesoft Enterprise Peopletools, Primavera Gateway, Primavera Unifier, Retail Customer Management And Segmentation Foundation · Siemens: Sinec Ins

1 product

17 products

Banking Corporate Lending Process Management

Banking Credit Facilities Process Management

Banking Extensibility Workbench

Banking Supply Chain Finance

Banking Trade Finance Process Management

Communications Cloud Native Core Policy

Communications Design Studio

Communications Services Gatekeeper

Communications Session Border Controller

Enterprise Communications Broker

Financial Services Crime And Compliance Management Studio

Health Sciences Data Management Workbench

Jd Edwards Enterpriseone Tools

Peoplesoft Enterprise Peopletools

Primavera Gateway

Primavera Unifier

Retail Customer Management And Segmentation Foundation

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Lodash Lodash	Before 4.17.21

Configuration B

38 vulnerable

Vulnerable Software	Affected Versions
Oracle Banking Corporate Lending Process Management	Version 14.2.0
Oracle Banking Corporate Lending Process Management	Version 14.3.0
Oracle Banking Corporate Lending Process Management	Version 14.5.0
Oracle Banking Credit Facilities Process Management	Version 14.2.0
Oracle Banking Credit Facilities Process Management	Version 14.3.0
Oracle Banking Credit Facilities Process Management	Version 14.5.0
Oracle Banking Extensibility Workbench	Version 14.2.0
Oracle Banking Extensibility Workbench	Version 14.3.0
Oracle Banking Extensibility Workbench	Version 14.5.0
Oracle Banking Supply Chain Finance	Version 14.2.0
Oracle Banking Supply Chain Finance	Version 14.3.0
Oracle Banking Supply Chain Finance	Version 14.5.0
Oracle Banking Trade Finance Process Management	Version 14.2.0
Oracle Banking Trade Finance Process Management	Version 14.3.0
Oracle Banking Trade Finance Process Management	Version 14.5.0
Oracle Communications Cloud Native Core Policy	Version 1.11.0
Oracle Communications Design Studio	Version 7.4.2
Oracle Communications Services Gatekeeper	Version 7.0
Oracle Communications Session Border Controller	Version 8.4
Oracle Communications Session Border Controller	Version 9.0
Oracle Enterprise Communications Broker	Version 3.2.0
Oracle Enterprise Communications Broker	Version 3.3.0
Oracle Financial Services Crime And Compliance Management Studio	Version 8.0.8.2.0
Oracle Financial Services Crime And Compliance Management Studio	Version 8.0.8.3.0
Oracle Health Sciences Data Management Workbench	Version 2.5.2.1
Oracle Health Sciences Data Management Workbench	Version 3.0.0.0
Oracle Jd Edwards Enterpriseone Tools	Before 9.2.6.1
Oracle Peoplesoft Enterprise Peopletools	Version 8.58
Oracle Peoplesoft Enterprise Peopletools	Version 8.59
Oracle Primavera Gateway	From 17.12.0 to 17.12.11
Oracle Primavera Gateway	From 18.8.0 to 18.8.12
Oracle Primavera Gateway	From 19.12.0 to 19.12.11
Oracle Primavera Gateway	From 20.12.0 to 20.12.7
Oracle Primavera Unifier	From 17.7 to 17.12
Oracle Primavera Unifier	Version 18.8
Oracle Primavera Unifier	Version 19.12
Oracle Primavera Unifier	Version 20.12
Oracle Retail Customer Management And Segmentation Foundation	Version 19.0

Configuration C

3 vulnerable

Vulnerable Software	Affected Versions
Siemens Sinec Ins	Before 1.0
Siemens Sinec Ins	Version 1.0
Siemens Sinec Ins	Version 1.0 sp1

References (28)

https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf

Source: report@snyk.io

PatchThird Party Advisory

https://github.com/lodash/lodash/blob/npm/trimEnd.js%23L8

Source: report@snyk.io

Broken Link

https://github.com/lodash/lodash/pull/5065

Source: report@snyk.io

PatchThird Party Advisory

https://security.netapp.com/advisory/ntap-20210312-0006/

Source: report@snyk.io

Third Party Advisory

https://snyk.io/vuln/SNYK-JAVA-ORGFUJIONWEBJARS-1074896

Source: report@snyk.io

ExploitThird Party Advisory

https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1074894

Source: report@snyk.io

ExploitThird Party Advisory

https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1074892

Source: report@snyk.io

ExploitThird Party Advisory

https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBLODASH-1074895

Source: report@snyk.io

ExploitThird Party Advisory

https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1074893

Source: report@snyk.io

ExploitThird Party Advisory

https://snyk.io/vuln/SNYK-JS-LODASH-1018905

Source: report@snyk.io

ExploitThird Party Advisory

https://www.oracle.com//security-alerts/cpujul2021.html

Source: report@snyk.io

Not ApplicableThird Party Advisory

https://www.oracle.com/security-alerts/cpujan2022.html

Source: report@snyk.io

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpujul2022.html

Source: report@snyk.io

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpuoct2021.html

Source: report@snyk.io

PatchThird Party Advisory

https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://github.com/lodash/lodash/blob/npm/trimEnd.js%23L8

Source: af854a3a-2127-422b-91ae-364da2661108

Broken Link

https://github.com/lodash/lodash/pull/5065

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://security.netapp.com/advisory/ntap-20210312-0006/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://snyk.io/vuln/SNYK-JAVA-ORGFUJIONWEBJARS-1074896

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1074894

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1074892

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBLODASH-1074895

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1074893

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

https://snyk.io/vuln/SNYK-JS-LODASH-1018905

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

https://www.oracle.com//security-alerts/cpujul2021.html

Source: af854a3a-2127-422b-91ae-364da2661108

Not ApplicableThird Party Advisory

https://www.oracle.com/security-alerts/cpujan2022.html

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpujul2022.html

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpuoct2021.html

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

Timeline

No history available yet.