CVE-2020-4072 Log Forging in generator-jhipster-kotlin
Attackers can forge log entries via invalid password reset attempts in JHipster Kotlin generated apps using JWT or session auth.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-4072?
CVE-2020-4072 is a medium-severity vulnerability in jhipster-kotlin, published on 25 Jun 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In generator-jhipster-kotlin version 1.6.0 log entries are created for invalid password reset attempts. As the email is provided by a user and the api is public this can be used by an attacker to forge log entries. This is vulnerable to https://cwe.mitre.org/data/definitions/117.html This problem affects only application generated with jwt or session authentication. Applications using oauth are not vulnerable. This issue has been fixed in version 1.7.0.
Weakness: CWE-117
Which versions are affected by CVE-2020-4072?
2 open source packages ship an affected version, including generator-jhipster-kotlin. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
generator-jhipster-kotlin npm | From 1.6.0 | 1.7.0 |
generator-jhipster-kotlin npm | From 1.6.0 | 1.7.0 |
Products include Jhipster Generator-Jhipster-Kotlin.
How do I fix CVE-2020-4072?
Upgrade generator-jhipster-kotlin to 1.7.0 or later.
Is CVE-2020-4072 being exploited?
There is no known exploitation of CVE-2020-4072 in the wild and no public exploit code.
Sources
Also known as GHSA-pfxf-wh96-fvjc.