CVE-2020-7760: codemirror Uncontrolled Resource Consumption
Vulnerability summary
CVE-2020-7760 is a high (CVSS 7.5) Uncontrolled Resource Consumption vulnerability in codemirror. EPSS estimates a 5.30% chance of exploitation in the next 30 days, higher than 92.4% of scored vulnerabilities. 7 public exploits are recorded.
Timeline
- 30-10-2020PublishedVulnerability first disclosed.
- 17-09-2024Last modifiedVulnerability information updated.
Description
This affects the package codemirror before 5.58.2; the package org.apache.marmotta.webjars:codemirror before 5.58.2. The vulnerable regular expression is located in https://github.com/codemirror/CodeMirror/blob/cdb228ac736369c685865b122b736cd0d397836c/mode/javascript/javascript.jsL129. The ReDOS vulnerability of the regex is mainly due to the sub-pattern (s|/*.*?*/)*
CVSS metrics
6 scores · 5 sources · 2 versions- CVE.orgCNA5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:CDiffers
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · NpmEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LDiffers
EPSS trend
Probability
5.30%
Chance of exploitation in the next 30 days
Percentile
92%
Versus all other CVEs
30-day change
0.00 pp
From 5.30% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
7 foundExploit Reference (snyk.io)
Maturity: unknown
Exploit Reference (snyk.io)
Maturity: unknown
Exploit Reference (snyk.io)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Oracle5 products
- application_express< 20.2
- enterprise_manager_express_user_interface19c
- essbase21.2
- hyperion_data_relationship_management< 11.2.9.0
- spatial_studio< 19.1.0
Codemirror1 product
- codemirror< 5.58.2
Debian1 product
- codemirror-js< 5.58.2+~cs0.23.101-1 | < 5.43.0-1+deb10u1
Npm1 product
- codemirror< 5.58.2
Ubuntu1 product
- codemirror-jsAll versions (No fix recorded)
5 vendors · 9 products
References
17 links- snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBCOMPONENTS-1024446X Refsource MISCREPORTWEBExploitThird Party Advisory
- snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBCODEMIRROR-1024448X Refsource MISCREPORTWEBExploitThird Party Advisory
- snyk.io/vuln/SNYK-JAVA-ORGAPACHEMARMOTTAWEBJARS-1024450X Refsource MISCREPORTWEBExploitThird Party Advisory
- github.com/codemirror/CodeMirror/commit/55d0333907117c9231ffdf555ae8824705993bbbX Refsource MISCREPORTWEBPatchThird Party Advisory
