This affects the package codemirror before 5.58.2; the package org.apache.marmotta.webjars:codemirror before 5.58.2. The vulnerable regular expression is located in https://github.com/codemirror/CodeMirror/blob/cdb228ac736369c685865b122b736cd0d397836c/mode/javascript/javascript.jsL129. The ReDOS vulnerability of the regex is mainly due to the sub-pattern (s|/*.*?*/)*

The version of Oracle Business Intelligence Enterprise Edition (OAS) 7.0.0.0 installed on the remote host is affected by multiple vulnerabilities as referenced in the January 2025 CPU advisory, including the following:

  - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics     (component: Analytics Server (SciPy)). Supported versions that are affected are 7.0.0.0.0 and 7.6.0.0.0.     Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to     compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability can     result in takeover of Oracle Business Intelligence Enterprise Edition. (CVE-2023-29824)

  - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics     (component: Platform Security (OpenSSL)). Supported versions that are affected are 7.0.0.0.0, 7.6.0.0.0     and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via     TLS to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this     vulnerability can result in unauthorized access to critical data or complete access to all Oracle Business     Intelligence Enterprise Edition accessible data and unauthorized ability to cause a hang or frequently     repeatable crash (complete DOS) of Oracle Business Intelligence Enterprise Edition. (CVE-2024-5535)

  - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics     (component: Analytics Server, Pipeline Test Failures, Installation (Spring Framework)). Supported versions     that are affected are 7.0.0.0.0, 7.6.0.0.0 and 12.2.1.4.0. Easily exploitable vulnerability allows     unauthenticated attacker with network access via HTTP to compromise Oracle Business Intelligence     Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause     a partial denial of service (partial DOS) of Oracle Business Intelligence Enterprise Edition.     (CVE-2024-38809)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The versions of Oracle Siebel CRM installed on the remote host are affected by a vulnerability as referenced in the July 2023 CPU advisory.

  - Vulnerability in the Siebel CRM product of Oracle Siebel CRM (component: UI Framework (CodeMirror)).
    Supported versions that are affected are 22.12 and prior. Easily exploitable vulnerability allows     unauthenticated attacker with network access via HTTP to compromise Siebel CRM. Successful attacks of this     vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete     DOS) of Siebel CRM. (CVE-2020-7760)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The versions of Oracle Database Server installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2021 CPU advisory.

  - Vulnerability in the Advanced Networking Option component of Oracle Database Server. Supported versions     that are affected are 12.1.0.2 and 19c. Difficult to exploit vulnerability allows unauthenticated attacker     with network access via Oracle Net to compromise Advanced Networking Option. Successful attacks require     human interaction from a person other than the attacker and while the vulnerability is in Advanced     Networking Option, attacks may significantly impact additional products. Successful attacks of this     vulnerability can result in takeover of Advanced Networking Option. (CVE-2021-2351)

  - Vulnerability in the Oracle Text component of Oracle Database Server. Supported versions that are affected     are 12.1.0.2 and 19c. Easily exploitable vulnerability allows high privileged attacker having Create Any     Procedure, Alter Any Table privilege with network access via Oracle Net to compromise Oracle Text.
    Successful   attacks of this vulnerability can result in takeover of Oracle Text. (CVE-2021-2328)

  - Vulnerability in the Oracle XML DB component of Oracle Database Server. Supported versions that are     affected   are 12.1.0.2 and 19c. Easily exploitable vulnerability allows high privileged attacker having     Create Any   Procedure, Create Public Synonym privilege with network access via Oracle Net to compromise     Oracle XML DB.   Successful attacks of this vulnerability can result in takeover of Oracle XML DB.
    (CVE-2021-2329)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The versions of Oracle Database Server installed on the remote host are affected by multiple vulnerabilities as referenced in the April 2021 CPU advisory. 

  - Vulnerability in the Oracle Database - Enterprise Edition Security (Dell BSAFE Micro Edition Suite)   component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1, 18c   and 19c. Easily exploitable vulnerability allows unauthenticated attacker with network access via   multiple protocols to compromise Oracle Database - Enterprise Edition Security (Dell BSAFE Micro Edition Suite).   Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently   repeatable crash (complete DOS) of Oracle Database - Enterprise Edition Security (Dell BSAFE Micro Edition Suite)   (CVE-2020-5360).

  - Vulnerability in the Workload Manager (Apache Tomcat) component of Oracle Database Server. Supported versions   that are affected are 18c and 19c. Easily exploitable vulnerability allows unauthenticated attacker with network   access via HTTP to compromise Workload Manager (Apache Tomcat). Successful attacks of this vulnerability can   result in unauthorized access to critical data or complete access to all Workload Manager (Apache Tomcat)   accessible data (CVE-2020-17527).

  - Vulnerability in the Oracle Database - Enterprise Edition (Dell BSAFE Crypto-J) component of Oracle Database   Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1, 18c and 19c. Easily exploitable vulnerability   allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Database - Enterprise   Edition (Dell BSAFE Crypto-J). Successful attacks require human interaction from a person other than the attacker.   Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to   all Oracle Database - Enterprise Edition (Dell BSAFE Crypto-J) accessible data (CVE-2019-3740). 

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It was discovered that codemirror, a browser-based text editor implemented in JavaScript, was vulnerable to regular expression denial-of-service.

ID	Name	Product	Family	Severity
214600	Oracle Business Intelligence Enterprise Edition (OAS 7.0) (January 2025 CPU)	Nessus	Misc.	critical
212435	Oracle Siebel Server <= 22.12 (July 2023 CPU)	Nessus	Misc.	high
152026	Oracle Database Server Multiple Vulnerabilities (Jul 2021 CPU)	Nessus	Databases	critical
148894	Oracle Database Server Multiple Vulnerabilities (Apr 2021 CPU)	Nessus	Databases	high
142885	Debian DSA-4789-1 : codemirror-js - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2020-7760

high

Tenable Plugins

critical

high

critical

high

high