NetSight
IP …
medium5.3

CVE-2020-7760

Regular expression denial of service in codemirror

Impact

This affects the package codemirror before 5.58.2; the package org.apache.marmotta.webjars:codemirror before 5.58.2. The vulnerable regular expression is located in https://github.com/codemirror/CodeMirror/blob/cdb228ac736369c685865b122b736cd0d397836c/mode/javascript/javascript.jsL129. The ReDOS vulnerability of the regex is mainly due to the sub-pattern (s|/*.*?*/)*

Affected packages

EcosystemPackageAffectedFixed in
npmcodemirror< 5.58.25.58.2

Affected products

VendorProductAffected versions
CodemirrorCodemirror
before 5.58.2
OracleApplication Express
before 20.2
OracleEnterprise Manager Express User Interface
Version 19c
OracleEssbase
Version 21.2
OracleHyperion Data Relationship Management
before 11.2.9.0
OracleSpatial Studio
before 19.1.0

Weakness classification

CWE-400

References