CVE-2015-20110

Katalog CVE

CVSS 7.5 · High EPSS 0,59%

Kerentanan Improper Restriction of Excessive Authentication Attempts pada jhipster. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

JHipster generator-jhipster before 2.23.0 allows a timing attack against validateToken due to a string comparison that stops at the first character that is different. Attackers can guess tokens by brute forcing one character at a time and observing the timing. This of course drastically reduces the search space to a linear amount of guesses based on the token length times the possible characters.

Rincian

Terbit di NVD

31 Oktober 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-307: Improper Restriction of Excessive Authentication Attempts

EPSS (30 hari)

0,59% peluang dieksploitasi; lebih tinggi dari 46,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/jhipster/generator-jhipster/issues/2095 issue tracking · patch · advisory vendor
• https://github.com/jhipster/generator-jhipster/commit/79fe5626cb1bb80f9ac86cf46980748e65d2bdbc patch
• https://github.com/jhipster/generator-jhipster/commit/7c49ab3d45dc4921b831a2ca55fb1e2a2db1ee25 patch
• https://github.com/jhipster/generator-jhipster/compare/v2.22.0...v2.23.0 patch · release notes