← Back to CVEs
CVE-2019-16303
CRITICAL9.8
Description
A class generated by the Generator in JHipster before 6.3.0 and JHipster Kotlin through 1.1.0 produces code that uses an insecure source of randomness (apache.commons.lang3 RandomStringUtils). This allows an attacker (if able to obtain their own password reset URL) to compute the value for all other password resets for other accounts, thus allowing privilege escalation or account takeover.
CVE Details
CVSS v3.1 Score9.8
SeverityCRITICAL
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack VectorNETWORK
ComplexityLOW
Privileges RequiredNONE
User InteractionNONE
Published9/14/2019
Last Modified11/21/2024
Sourcenvd
Honeypot Sightings0
Affected Products
jhipster:jhipsterjhipster:jhipster_kotlin
Weaknesses (CWE)
CWE-338
References
https://github.com/jhipster/generator-jhipster/commit/88448b85fd3e8e49df103f0061359037c2c68ea7(cve@mitre.org)
https://github.com/jhipster/generator-jhipster/issues/10401(cve@mitre.org)
https://github.com/jhipster/generator-jhipster/security/advisories/GHSA-mwp6-j9wf-968c(cve@mitre.org)
https://github.com/jhipster/jhipster-kotlin/issues/183(cve@mitre.org)
https://lists.apache.org/thread.html/r6d243e7e3f25daeb242dacf3def411fba32a9388d3ff84918cb28ddd%40%3Cissues.commons.apache.org%3E(cve@mitre.org)
https://lists.apache.org/thread.html/rc3f00f5d3d2ec0e2381a3b9096d5f5b4d46ec1587ee7e251a3dbb897%40%3Cissues.commons.apache.org%3E(cve@mitre.org)
https://lists.apache.org/thread.html/rc87fa35a48b5d70b06af6fb81785ed82e82686eb83307aae6d250dc9%40%3Cissues.commons.apache.org%3E(cve@mitre.org)
https://github.com/jhipster/generator-jhipster/commit/88448b85fd3e8e49df103f0061359037c2c68ea7(af854a3a-2127-422b-91ae-364da2661108)
https://github.com/jhipster/generator-jhipster/issues/10401(af854a3a-2127-422b-91ae-364da2661108)
https://github.com/jhipster/generator-jhipster/security/advisories/GHSA-mwp6-j9wf-968c(af854a3a-2127-422b-91ae-364da2661108)
https://github.com/jhipster/jhipster-kotlin/issues/183(af854a3a-2127-422b-91ae-364da2661108)
https://lists.apache.org/thread.html/r6d243e7e3f25daeb242dacf3def411fba32a9388d3ff84918cb28ddd%40%3Cissues.commons.apache.org%3E(af854a3a-2127-422b-91ae-364da2661108)
https://lists.apache.org/thread.html/rc3f00f5d3d2ec0e2381a3b9096d5f5b4d46ec1587ee7e251a3dbb897%40%3Cissues.commons.apache.org%3E(af854a3a-2127-422b-91ae-364da2661108)
https://lists.apache.org/thread.html/rc87fa35a48b5d70b06af6fb81785ed82e82686eb83307aae6d250dc9%40%3Cissues.commons.apache.org%3E(af854a3a-2127-422b-91ae-364da2661108)
https://www.jhipster.tech/2019/09/13/jhipster-release-6.3.0.html(af854a3a-2127-422b-91ae-364da2661108)
IOC Correlations
No correlations recorded
This product uses data from the NVD API but is not endorsed or certified by the NVD.