CVE-2020-7760

Published: Oct 30, 2020Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

This affects the package codemirror before 5.58.2; the package org.apache.marmotta.webjars:codemirror before 5.58.2. The vulnerable regular expression is located in https://github.com/codemirror/CodeMirror/blob/cdb228ac736369c685865b122b736cd0d397836c/mode/javascript/javascript.jsL129. The ReDOS vulnerability of the regex is mainly due to the sub-pattern (s|/*.*?*/)*

Affected (6)

Products: Codemirror: Codemirror · Oracle: Application Express, Enterprise Manager Express User Interface, Essbase, Hyperion Data Relationship Management, Spatial Studio

1 product

5 products

Application Express

Enterprise Manager Express User Interface

Hyperion Data Relationship Management

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Codemirror Codemirror	Before 5.58.2

Configuration B

5 vulnerable

Vulnerable Software	Affected Versions
Oracle Application Express	Before 20.2
Oracle Enterprise Manager Express User Interface	Version 19c
Oracle Essbase	Version 21.2
Oracle Hyperion Data Relationship Management	Before 11.2.9.0
Oracle Spatial Studio	Before 19.1.0

Related CWEs

Uncontrolled Resource Consumption

The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.

References (24)

https://github.com/codemirror/CodeMirror/commit/55d0333907117c9231ffdf555ae8824705993bbb

Source: report@snyk.io

PatchThird Party Advisory

https://snyk.io/vuln/SNYK-JAVA-ORGAPACHEMARMOTTAWEBJARS-1024450

Source: report@snyk.io

ExploitThird Party Advisory

https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1024449

Source: report@snyk.io

ExploitThird Party Advisory

https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1024445

Source: report@snyk.io

ExploitThird Party Advisory

https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBCODEMIRROR-1024448

Source: report@snyk.io

ExploitThird Party Advisory

https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBCOMPONENTS-1024446

Source: report@snyk.io

ExploitThird Party Advisory

https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1024447

Source: report@snyk.io

ExploitThird Party Advisory

https://snyk.io/vuln/SNYK-JS-CODEMIRROR-1016937

Source: report@snyk.io

ExploitThird Party Advisory

https://www.debian.org/security/2020/dsa-4789

Source: report@snyk.io

Third Party Advisory

https://www.oracle.com//security-alerts/cpujul2021.html

Source: report@snyk.io

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpuApr2021.html

Source: report@snyk.io

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpuapr2022.html

Source: report@snyk.io

PatchThird Party Advisory

https://github.com/codemirror/CodeMirror/commit/55d0333907117c9231ffdf555ae8824705993bbb

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://snyk.io/vuln/SNYK-JAVA-ORGAPACHEMARMOTTAWEBJARS-1024450

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1024449

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1024445

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBCODEMIRROR-1024448

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBCOMPONENTS-1024446

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1024447

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

https://snyk.io/vuln/SNYK-JS-CODEMIRROR-1016937

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

https://www.debian.org/security/2020/dsa-4789

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://www.oracle.com//security-alerts/cpujul2021.html

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpuApr2021.html

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpuapr2022.html

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

Timeline

No history available yet.