CVE-2020-4072: generator-jhipster-kotlin

csirt@kutim:~/threat-intel/cve/CVE-2020-4072

CVSS 5.3 · Medium EPSS 1,2%

Kerentanan Improper Output Neutralization for Logs pada generator-jhipster-kotlin. Skor CVSS 3.1 5.3 (Medium) menurut NVD.

Deskripsi (NVD)

In generator-jhipster-kotlin version 1.6.0 log entries are created for invalid password reset attempts. As the email is provided by a user and the api is public this can be used by an attacker to forge log entries. This is vulnerable to https://cwe.mitre.org/data/definitions/117.html This problem affects only application generated with jwt or session authentication. Applications using oauth are not vulnerable. This issue has been fixed in version 1.7.0.

Rincian

Terbit di NVD: 25 Juni 2020
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 5.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-117: Improper Output Neutralization for Logs
EPSS (30 hari): 1,2% peluang dieksploitasi; lebih tinggi dari 67,7% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
jhipster	generator-jhipster-kotlin	Semua versi sebelum 1.7.0

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/jhipster/jhipster-kotlin/commit/426ccab85e7e0da562643200637b99b6a2a99449 patch · advisory pihak ketiga
https://github.com/jhipster/jhipster-kotlin/security/advisories/GHSA-pfxf-wh96-fvjc advisory pihak ketiga
https://owasp.org/www-community/attacks/Log_Injection deskripsi teknis
https://www.baeldung.com/jvm-log-forging deskripsi teknis

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.