CVE-2020-7760: 
JavaScript vulnerability analysis and mitigation

CVE-2020-7760 affects the CodeMirror package before version 5.58.2, including org.apache.marmotta.webjars:codemirror. The vulnerability was discovered in October 2020 and impacts the JavaScript mode component of the CodeMirror text editor (Debian Advisory, Oracle Advisory).

The vulnerability is related to a potentially exponential regular expression in the JavaScript mode component of CodeMirror. The issue was fixed by modifying the regular expression pattern that handles async keyword matching (GitHub Commit). The vulnerability has a CVSS 3.1 Base Score of 4.3 (Availability impacts), with attack vector being Network, low attack complexity, requiring low privileges, and no user interaction (Oracle Advisory).

Successful exploitation of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of systems using the affected CodeMirror component (Oracle Advisory).

The vulnerability is easily exploitable by low privileged attackers with network access via HTTP. It does not require user interaction to exploit (Oracle Advisory).

The vulnerability has been fixed in CodeMirror version 5.58.2. Users should upgrade to this version or later to mitigate the issue. Debian has released security update DSA-4789-1 for the codemirror-js package to address this vulnerability (Debian Advisory).