CVE-2020-28500

Katalog CVE

CVSS 5.3 · Medium EPSS 7,3%

Kerentanan pada lodash, oracle banking corporate lending process management +17 lainnya. Skor CVSS 3.1 5.3 (Medium) menurut NVD.

Deskripsi (NVD)

Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.

Rincian

Terbit di NVD

15 Februari 2021

Terakhir diubah

8 Oktober 2026

Status NVD

Modified

CVSS 3.1

5.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L · uraikan di kalkulator

EPSS (30 hari)

7,3% peluang dieksploitasi; lebih tinggi dari 94,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf patch · advisory pihak ketiga
• https://github.com/lodash/lodash/pull/5065 patch · advisory pihak ketiga
• https://www.oracle.com/security-alerts/cpujan2022.html patch · advisory pihak ketiga
• https://www.oracle.com/security-alerts/cpujul2022.html patch · advisory pihak ketiga
• https://www.oracle.com/security-alerts/cpuoct2021.html patch · advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20210312-0006/ advisory pihak ketiga
• https://snyk.io/vuln/SNYK-JAVA-ORGFUJIONWEBJARS-1074896 exploit · advisory pihak ketiga
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1074894 exploit · advisory pihak ketiga
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1074892 exploit · advisory pihak ketiga
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBLODASH-1074895 exploit · advisory pihak ketiga
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1074893 exploit · advisory pihak ketiga
• https://snyk.io/vuln/SNYK-JS-LODASH-1018905 exploit · advisory pihak ketiga
• https://www.oracle.com//security-alerts/cpujul2021.html not applicable · advisory pihak ketiga
• https://github.com/lodash/lodash/blob/npm/trimEnd.js%23L8 broken link