CVE-2020-28500

MediumCVSS 5.3/10Last modified Oct 8, 2026

Description

Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected software

No affected versions have been published.

Timeline

Published
Feb 15, 2021
Last modified
Oct 8, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-285017.5This affects the package es6-crawler-detect before 3.1.3. No limitation of user agent string length supplied to regex operators.CVE-2020-285028.1This affects the package xmlhttprequest before 1.7.0; all versions of package xmlhttprequest-ssl. Provided requests are sent synchronously (CVE-2020-285039.8The package copy-props before 2.0.5 are vulnerable to Prototype Pollution via the main functionality.CVE-2020-28517.8Vulnerability in the Oracle Solaris product of Oracle Systems (component: Common Desktop Environment). Supported versions that are affected CVE-2020-28528.2Vulnerability in the Oracle Advanced Outbound Telephony product of Oracle E-Business Suite (component: Calendar). Supported versions that arCVE-2020-28534.9Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions that are affected arCVE-2020-28548.2Vulnerability in the Oracle Advanced Outbound Telephony product of Oracle E-Business Suite (component: User Interface). Supported versions tCVE-2020-28558.2Vulnerability in the Oracle iSupport product of Oracle E-Business Suite (component: Admin). Supported versions that are affected are 12.1.1-CVE-2020-28568.2Vulnerability in the Oracle Advanced Outbound Telephony product of Oracle E-Business Suite (component: User Interface). Supported versions tCVE-2020-28578.2Vulnerability in the Oracle Advanced Outbound Telephony product of Oracle E-Business Suite (component: User Interface). Supported versions tCVE-2020-285727.8A vulnerability in Trend Micro Apex One could allow an unprivileged user to abuse the product installer to reinstall the agent with additionCVE-2020-285735.3An improper access control information disclosure vulnerability in Trend Micro Apex One and OfficeScan XG SP1 could allow an unauthenticated
CVE-2020-28500: Medium severity, CVSS 5.3 | Vulnix