Insecure Randomness in JHipster Framework and Kotlin Plugin

CVE-2019-16303

What is CVE-2019-16303?

The JHipster framework, prior to version 6.3.0, and the JHipster Kotlin plugin up to version 1.1.0, exhibit a flaw where the RandomStringUtils class from Apache Commons Lang is used to generate sensitive values with an inadequate source of randomness. This vulnerability can be exploited if an attacker gains access to a password reset URL, allowing them to accurately predict the values for password resets associated with other users' accounts, resulting in potential privilege escalation or unauthorized account access.

References