CVE-2020-36649
published 2023-01-11CVE-2020-36649: A vulnerability was found in mholt PapaParse up to 5.1.x. It has been classified as problematic. Affected is an unknown function of the file papaparse.js. The…
PriorityP339high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
1.39%
69.4th percentile
A vulnerability was found in mholt PapaParse up to 5.1.x. It has been classified as problematic. Affected is an unknown function of the file papaparse.js. The manipulation leads to inefficient regular expression complexity. Upgrading to version 5.2.0 is able to address this issue. The name of the patch is 235a12758cd77266d2e98fd715f53536b34ad621. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-218004.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | mediawiki | < mediawiki 1:1.39.4-1~deb12u1 (bookworm) | mediawiki 1:1.39.4-1~deb12u1 (bookworm) |
| mediawiki | mediawiki | >= 0 < 1:1.35.11-1~deb11u1 | 1:1.35.11-1~deb11u1 |
| mediawiki | mediawiki | >= 0 < 1:1.39.4-1~deb12u1 | 1:1.39.4-1~deb12u1 |
| mediawiki | mediawiki | >= 0 < 1:1.39.4-1 | 1:1.39.4-1 |
| mediawiki | mediawiki | >= 0 < 1:1.39.4-1 | 1:1.39.4-1 |
| mholt | papaparse | — | — |
| mholt | papaparse | — | — |
| papaparse | papaparse | >= 0 < 5.2.0 | 5.2.0 |
| papaparse | papaparse | >= 5.1.0 < 5.2.0 | 5.2.0 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.02.3LOWAV:A/AC:M/Au:S/C:N/I:N/A:P
osv7.5HIGH
vendor_debian3.5LOW
vendor_redhat3.5LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2020-36649: A vulnerability was found in mholt PapaParse up to 5
osv·2023-01-11·CVSS 7.5
CVE-2020-36649 [HIGH] CVE-2020-36649: A vulnerability was found in mholt PapaParse up to 5
A vulnerability was found in mholt PapaParse up to 5.1.x. It has been classified as problematic. Affected is an unknown function of the file papaparse.js. The manipulation leads to inefficient regular expression complexity. Upgrading to version 5.2.0 is able to address this issue. The name of the patch is 235a12758cd77266d2e98fd715f53536b34ad621. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-218004.
GHSA
Regular Expression Denial of Service in papaparse
ghsa·2020-09-04
CVE-2020-36649 [HIGH] CWE-185 Regular Expression Denial of Service in papaparse
Regular Expression Denial of Service in papaparse
Versions of `papaparse` prior to 5.2.0 are vulnerable to Regular Expression Denial of Service (ReDos). The `parse` function contains a malformed regular expression that takes exponentially longer to process non-numerical inputs. This allows attackers to stall systems and lead to Denial of Service.
## Recommendation
Upgrade to version 5.2.0 or later.
OSV
Regular Expression Denial of Service in papaparse
osv·2020-09-04
CVE-2020-36649 [HIGH] Regular Expression Denial of Service in papaparse
Regular Expression Denial of Service in papaparse
Versions of `papaparse` prior to 5.2.0 are vulnerable to Regular Expression Denial of Service (ReDos). The `parse` function contains a malformed regular expression that takes exponentially longer to process non-numerical inputs. This allows attackers to stall systems and lead to Denial of Service.
## Recommendation
Upgrade to version 5.2.0 or later.
Red Hat
papaparse: RegExp used to detect numbers is vulnerable to ReDoS
vendor_redhat·2023-01-11·CVSS 3.5
CVE-2020-36649 [LOW] CWE-1333 papaparse: RegExp used to detect numbers is vulnerable to ReDoS
papaparse: RegExp used to detect numbers is vulnerable to ReDoS
A vulnerability was found in mholt PapaParse up to 5.1.x. It has been classified as problematic. Affected is an unknown function of the file papaparse.js. The manipulation leads to inefficient regular expression complexity. Upgrading to version 5.2.0 is able to address this issue. The name of the patch is 235a12758cd77266d2e98fd715f53536b34ad621. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-218004.
A vulnerability was found in PapaParse. The affected function is present in the papaparse.js file. The manipulation leads to an inefficient regular expression complexity.
Package: servicemesh-grafana (OpenShift Service Mesh 2.1) - Not affected
Package: grafana (Red Hat Enterpri
Debian
CVE-2020-36649: mediawiki - A vulnerability was found in mholt PapaParse up to 5.1.x. It has been classified...
vendor_debian·2020·CVSS 3.5
CVE-2020-36649 [LOW] CVE-2020-36649: mediawiki - A vulnerability was found in mholt PapaParse up to 5.1.x. It has been classified...
A vulnerability was found in mholt PapaParse up to 5.1.x. It has been classified as problematic. Affected is an unknown function of the file papaparse.js. The manipulation leads to inefficient regular expression complexity. Upgrading to version 5.2.0 is able to address this issue. The name of the patch is 235a12758cd77266d2e98fd715f53536b34ad621. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-218004.
Scope: local
bookworm: resolved (fixed in 1:1.39.4-1~deb12u1)
bullseye: resolved (fixed in 1:1.35.11-1~deb11u1)
forky: resolved (fixed in 1:1.39.4-1)
sid: resolved (fixed in 1:1.39.4-1)
trixie: resolved (fixed in 1:1.39.4-1)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/mholt/PapaParse/commit/235a12758cd77266d2e98fd715f53536b34ad621https://github.com/mholt/PapaParse/issues/777https://github.com/mholt/PapaParse/pull/779https://github.com/mholt/PapaParse/releases/tag/5.2.0https://vuldb.com/?ctiid.218004https://vuldb.com/?id.218004https://github.com/mholt/PapaParse/commit/235a12758cd77266d2e98fd715f53536b34ad621https://github.com/mholt/PapaParse/issues/777https://github.com/mholt/PapaParse/pull/779https://github.com/mholt/PapaParse/releases/tag/5.2.0https://vuldb.com/?ctiid.218004https://vuldb.com/?id.218004
2023-01-11
Published