Free and open · new CVEs checked every 20 minutesStatusRSSOpen dataContact

CVE-2020-7760: This affects the package codemirror before 5.58.2; the package org.apache.marmotta.webjars:codemirror before 5

57
This week
MEDIUM 5.3REMOTEWATCHLISTUPGRADEUPGRADEDOWNGRADE

CVE-2020-7760 is a medium-severity flaw (CVSS 5.3) affecting codemirror, application express, enterprise manager express user interface. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

This affects the package codemirror before 5.58.2; the package org.apache.marmotta.webjars:codemirror before 5.58.2. The vulnerable regular expression is located in https://github.com/codemirror/CodeMirror/blob/cdb228ac736369c685865b122b736cd0d397836c/mode/javascript/javascript.jsL129. The ReDOS vulnerability of the regex is mainly due to the sub-pattern (s|/*.*?*/)*

Why this priority

  • EPSS top 7%: very likely to be exploited
  • Public exploit reference
  • Remotely exploitable, no login, no user action
  • On your watchlist

A fixed release or distro patch exists.

Risk facts

CVSS score5.3 (Medium)
Attack vectorNetwork (remote)
Attack complexityLow
Privileges neededNone
User interactionNone
EPSS exploit chance5.3% (top 7%)
CISA exploited listNo
WeaknessCWE-400
Published2020-10-30
Last modified2026-06-17
Publisher (CNA): Snyk · Vendor: codemirror · oracle

Share: LinkedIn · X · Reddit

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

codemirror codemirror UPGRADE
Affected: < 5.58.2
Fixed in: 5.58.2
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy codemirror || rpm -q codemirror || codemirror --version
2. UPGRADE to 5.58.2 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade codemirror
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade codemirror
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
oracle application express UPGRADE
Affected: < 20.2
Fixed in: 20.2
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy application-express || rpm -q application-express || application-express --version
2. UPGRADE to 20.2 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade application-express
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade application-express
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
oracle enterprise manager express user interface DOWNGRADE
Affected: 19c
Fixed in: no fixed release known
Safe to downgrade to: a release before 19c
1. Check installed version
apt-cache policy enterprise-manager-express-user-interface || rpm -q enterprise-manager-express-user-interface || enterprise-manager-express-user-interface --version
2. No fixed release: DOWNGRADE to a release before 19c (Debian / Ubuntu)
apt-cache madison enterprise-manager-express-user-interface sudo apt install enterprise-manager-express-user-interface=<VERSION_BEFORE_19c> sudo apt-mark hold enterprise-manager-express-user-interface
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list enterprise-manager-express-user-interface sudo dnf downgrade enterprise-manager-express-user-interface-<VERSION_BEFORE_19c> sudo dnf versionlock add enterprise-manager-express-user-interface
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
oracle essbase DOWNGRADE
Affected: 21.2
Fixed in: no fixed release known
Safe to downgrade to: a release before 21.2
1. Check installed version
apt-cache policy essbase || rpm -q essbase || essbase --version
2. No fixed release: DOWNGRADE to a release before 21.2 (Debian / Ubuntu)
apt-cache madison essbase sudo apt install essbase=<VERSION_BEFORE_21.2> sudo apt-mark hold essbase
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list essbase sudo dnf downgrade essbase-<VERSION_BEFORE_21.2> sudo dnf versionlock add essbase
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
oracle hyperion data relationship management UPGRADE
Affected: < 11.2.9.0
Fixed in: 11.2.9.0
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy hyperion-data-relationship-management || rpm -q hyperion-data-relationship-management || hyperion-data-relationship-management --version
2. UPGRADE to 11.2.9.0 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade hyperion-data-relationship-management
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade hyperion-data-relationship-management
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
oracle spatial studio UPGRADE
Affected: < 19.1.0
Fixed in: 19.1.0
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy spatial-studio || rpm -q spatial-studio || spatial-studio --version
2. UPGRADE to 19.1.0 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade spatial-studio
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade spatial-studio
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2020-7760?

codemirror: upgrade to 5.58.2; application express: upgrade to 20.2; enterprise manager express user interface: downgrade or apply the listed mitigation. Exact commands for each OS are on this page.

Is CVE-2020-7760 being exploited?

CVE-2020-7760 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2020-7760 affect?

CVE-2020-7760 affects codemirror, application express, enterprise manager express user interface. Severity is medium (CVSS 5.3). This affects the package codemirror before 5.58.2; the package org.apache.marmotta.webjars:codemirror before 5.58.2. The vulnerable regular expression is located in https://github.com/codemirror/CodeMirror/blob/cdb228ac736369c685865b122b736

How urgent is CVE-2020-7760?

Priority 57/100. EPSS top 7%: very likely to be exploited; Public exploit reference; Remotely exploitable, no login, no user action; On your watchlist

Software pages

GitHub vulnerabilities

References

← Back to latest CVEs

Get the weekly exploited-CVE digest by emailThe CVEs being attacked this week and how to fix them. No spam, unsubscribe any time.