GHSA-4cv2-xc5f-px8h: 
PHP vulnerability analysis and mitigation

The vulnerability (GHSA-4cv2-xc5f-px8h) affects the TYPO3 extension 'Code Highlight' (codehighlight) versions 2.4.0 and below. The issue was discovered in the bundled third-party JavaScript component 'prism' which was found to be vulnerable to Regular expression Denial of Service (ReDoS). The vulnerability was disclosed on March 16, 2021, with a moderate severity rating (TYPO3 Advisory).

The vulnerability has been assigned a CVSS v3.1 score of 5.0 (Moderate) with the following vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L/E:F/RL:O/RC:C. The attack vector is network-based, with low attack complexity and requiring low privileges. No user interaction is needed, and while the scope is changed, there is no impact on confidentiality or integrity, but there is a low impact on availability (GitHub Advisory).

The vulnerability could lead to a Denial of Service condition through Regular expression Denial of Service (ReDoS) attacks. This could affect the availability of systems using the vulnerable versions of the Code Highlight extension (TYPO3 Advisory).

The vulnerability requires network access and low privileges to exploit. No user interaction is necessary for exploitation, making it relatively straightforward to execute for attackers with the required access (GitHub Advisory).

The vulnerability has been patched in version 2.5.0 of the Code Highlight extension. Users are advised to update to this version as soon as possible. The updated version can be obtained through the TYPO3 extension manager, Packagist, or directly downloaded from the TYPO3 extension repository (TYPO3 Advisory).