PT-2020-17862 · Jhipster · Generator-Jhipster-Kotlin

Sendilkumarn · Published 2020-06-25 · Updated 2020-07-10 · CVE-2020-4072

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions generator-jhipster-kotlin version 1.6.0

Description The issue allows an attacker to forge log entries by creating log entries for invalid password reset attempts. This can be exploited because the email is provided by a user and the API is public. The problem affects only applications generated with JWT or session authentication, while applications using OAuth are not vulnerable.

Recommendations For generator-jhipster-kotlin version 1.6.0, as a temporary workaround, consider modifying the AccountResource.kt file by changing the line log.warn("Password reset requested for non existing mail '$mail'"); to log.warn("Password reset requested for non existing mail");. To fully resolve the issue, update to version 1.7.0.

Fix

Weakness Enumeration

CWE-117

Related Identifiers

CVE-2020-4072

GHSA-PFXF-WH96-FVJC

Affected Products

Generator-Jhipster-Kotlin

References · 8

• https://github.com/jhipster/jhipster-kotlin/commit/426ccab85e7e0da562643200637b99b6a2a99449 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-4072 · Security Note
• https://osv.dev/vulnerability/GHSA-pfxf-wh96-fvjc · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-4072 · Vendor Advisory
• https://github.com/jhipster/jhipster-kotlin/security/advisories/GHSA-pfxf-wh96-fvjc · Note
• https://baeldung.com/jvm-log-forging · Note
• https://owasp.org/www-community/attacks/Log_Injection · Note
• https://t.me/cvenotify/4664 · Telegram Post