LiveActive security incident?Get immediate response
CVE Record

CVE-2020-23314: There is an Assertion 'block_found' failed at js-parser-statm.c:2003 parser_parse_try_statement_end in Jerr...

There is an Assertion 'block_found' failed at js-parser-statm.c:2003 parser_parse_try_statement_end in JerryScript 2.2.0.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2020-23314 describes an assertion failure in JerryScript 2.2.0 while parsing a JavaScript try statement. In practical terms, crafted JavaScript input may cause the engine to abort. The public record provided does not include CVSS, CWE, deployment detail, active exploitation, or a named vendor fix.

Executive priority

Treat this as an exposure-discovery item unless JerryScript 2.2.0 is used on an untrusted input path. Business urgency is currently unclear because public sources do not provide severity scoring, exploitation evidence, or a named fix.

Technical view

The reported failure is assertion 'block_found' at js-parser-statm.c:2003 in parser_parse_try_statement_end. This indicates a parser state handling defect triggered during try-statement parsing in JerryScript 2.2.0. Available sources do not establish memory corruption, privilege impact, remote reachability, or affected downstream products.

Likely exposure

Exposure appears limited to software, firmware, or services that embed JerryScript 2.2.0 and parse JavaScript input. The CVE source bundle lists affected vendor and product as n/a, so downstream impact cannot be determined from the provided evidence.

Exploitation context

The source bundle marks this CVE as not in KEV and provides no evidence of active exploitation. The GitHub issue reference is the only technical source listed. Treat exploitability and real-world abuse as unconfirmed unless additional vendor or threat-intelligence evidence emerges.

Researcher notes

The evidence supports an assertion-triggered parser crash in JerryScript 2.2.0, but not broader impact. Avoid assuming remote code execution, memory corruption, or denial-of-service reachability without testing in a legitimate owned environment and checking upstream project context.

Mitigation direction

  • Inventory applications, firmware, and services that embed JerryScript 2.2.0.
  • Check JerryScript issue #3825 and vendor guidance for any maintained fix or upgrade recommendation.
  • Reduce untrusted JavaScript parsing through affected components where operationally feasible.
  • Prioritize remediation if JerryScript processes externally supplied scripts or network-delivered content.

Validation and detection

  • Confirm whether JerryScript 2.2.0 is present in builds, firmware images, or third-party dependencies.
  • Identify whether affected components parse JavaScript from untrusted users or external systems.
  • Review crash logs for JerryScript parser assertion failures referencing parser_parse_try_statement_end.
  • Track CVE and upstream issue updates for clarified impact, fixed versions, or mitigation guidance.
Prepared
Confidence
medium
Sources
3

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2020-23314 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
2Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.