CVE-2020-4072: Log Forging in generator-jhipster-kotlin
In generator-jhipster-kotlin version 1.6.0 log entries are created for invalid password reset attempts. As the email is provided by a user and the api is public this can be used by an attacker to forge log entries. This is vulnerable to https://cwe.mitre.org/data/definitions/117.html This problem affects only application generated with jwt or session authentication. Applications using oauth are not vulnerable. This issue has been fixed in version 1.7.0.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2020-4072?
CVE-2020-4072 is a vulnerability in generator-jhipster-kotlin version 1.6.0 where log entries are created for invalid password reset attempts.
How does CVE-2020-4072 work?
In generator-jhipster-kotlin version 1.6.0, log entries are created for invalid password reset attempts, which can be used by an attacker to forge log entries.
What is the severity of CVE-2020-4072?
The severity of CVE-2020-4072 is medium, with a severity value of 5.3.
How can CVE-2020-4072 be exploited?
CVE-2020-4072 can be exploited by providing a user-provided email and using the public API to forge log entries.
How do I fix CVE-2020-4072?
To fix CVE-2020-4072, update generator-jhipster-kotlin to version 1.7.0 or higher.