CVE-2020-36649

EUVD-2023-0378

11.01.2023, 15:15

A vulnerability was found in mholt PapaParse up to 5.1.x. It has been classified as problematic. Affected is an unknown function of the file papaparse.js. The manipulation leads to inefficient regular expression complexity. Upgrading to version 5.2.0 is able to address this issue. The name of the patch is 235a12758cd77266d2e98fd715f53536b34ad621. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-218004.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	3.5 LOW	ADJACENT_NETWORK	LOW	LOW	CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
VulDB	CNA	3.5 LOW				CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Base Score

CVSS 3.x

EPSS Score

Percentile: 53%

Affected Products (NVD)

Vendor	Product	Version
papaparse	papaparse	5.1.0 ≤ 𝑥 < 5.2.0

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

mediawiki

bookworm	1:1.39.7-1~deb12u1 fixed
bookworm (security)	1:1.39.10-1~deb12u1 fixed
bullseye	1:1.35.13-1+deb11u2 fixed
bullseye (security)	1:1.35.13-1+deb11u3 fixed
buster	not-affected
sid	1:1.39.10-1 fixed
trixie	1:1.39.10-1 fixed