Is CVE-2020-4072 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2020-4072 being exploited in the wild.

How severe is CVE-2020-4072?

Low severity, with a CVSS score of 3.1, published 25 June 2020.

Which products and versions are affected?

generator-jhipster-kotlin (npm) SEMVER:introduced=1.6.0,fixed=1.7.0.

Is there a fix for CVE-2020-4072?

Yes. generator-jhipster-kotlin (npm): upgrade to 1.7.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2020-4072 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2020-4072?

Check whether you run generator-jhipster-kotlin (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2020-4072: JHipster Kotlin generator log forging in password reset

CVE-2020-4072 · Severity: low · CVSS 3.1 · Published 2020-06-25

The JHipster Kotlin generator creates backend code for web applications. A vulnerability in the password reset feature allows attackers to inject log entries by submitting forged email addresses to a public API endpoint, potentially manipulating application logs for deception or evasion purposes. This affects applications using JWT or session authentication, but not those using OAuth.

Vendors: npm.

Quick answers

Is CVE-2020-4072 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2020-4072 being exploited in the wild.
How severe is CVE-2020-4072?: Low severity, with a CVSS score of 3.1, published 25 June 2020.
Which products and versions are affected?: generator-jhipster-kotlin (npm) SEMVER:introduced=1.6.0,fixed=1.7.0.
Is there a fix for CVE-2020-4072?: Yes. generator-jhipster-kotlin (npm): upgrade to 1.7.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2020-4072 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2020-4072?: Check whether you run generator-jhipster-kotlin (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

generator-jhipster-kotlin (npm): upgrade to 1.7.0 or later
```
npm install generator-jhipster-kotlin@1.7.0
```

Technical details

A log forging vulnerability (CWE-117) exists in the AccountResource.kt component of generated applications. When handling password reset requests for non-existent email addresses, the application logs the user-supplied email directly without sanitization, allowing an attacker to inject newlines and craft malicious log entries. The vulnerability is triggered via an unauthenticated, network-accessible password reset endpoint that accepts email parameters. An attacker can craft requests with email values containing log injection payloads to forge arbitrary log entries. The issue is fixed in version 1.7.0 by removing the email from log output entirely.

Affected products

JHipster generator-jhipster-kotlin 1.6.0 before 1.7.0

Identifiers

CVE-2020-4072
GHSA-pfxf-wh96-fvjc

Timeline

2020-06-25: disclosed: Advisory published
2020-06-25: patched: Version 1.7.0 released with fix

References

https://github.com/jhipster/jhipster-kotlin/security/advisories/GHSA-pfxf-wh96-fvjc

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.