CVE-2020-28500
MediumPublic PoC
Published: 15 February 2021
Published
15 February 2021
Modified
21 November 2024
KEV Added
—
Patch
—
CVSS Score v3.1
5.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
EPSS Score
0.0018
39.4th percentile
Risk Priority
11
60% EPSS · 20% KEV · 20% CVSS
Summary
CVE-2020-28500 is a medium-severity an unspecified weakness vulnerability in Oracle Primavera Gateway. Its CVSS base score is 5.3 (Medium).
Operationally, ranked at the 39.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-0424
Vulnerability details
Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
lodash
lodash
≤ 4.17.21
oracle
banking corporate lending process management
14.2.0, 14.3.0, 14.5.0
oracle
banking credit facilities process management
14.2.0, 14.3.0, 14.5.0
oracle
banking extensibility workbench
14.2.0, 14.3.0, 14.5.0
oracle
banking supply chain finance
14.2.0, 14.3.0, 14.5.0
oracle
banking trade finance process management
14.2.0, 14.3.0, 14.5.0
oracle
communications cloud native core policy
1.11.0
oracle
communications design studio
7.4.2
oracle
communications services gatekeeper
7.0
oracle
communications session border controller
8.4, 9.0
+9 more product configuration(s) — see NVD for full list
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.