CVE-2015-20110
High
Description
JHipster generator-jhipster before 2.23.0 allows a timing attack against validateToken due to a string comparison that stops at the first character that is different. Attackers can guess tokens by brute forcing one character at a time and observing the timing. This of course drastically reduces the search space to a linear amount of guesses based on the token length times the possible characters.
SeverityHigh
CVSS7.5
Exploit probability—
ProductJhipster
PublishedOct 31, 2023
First seenOct 31, 2023
How to fix
Update
- jhipster jhipster2.23.0 or later
- generator-jhipster2.23.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| jhipster jhipster | v < 2.23.0 | 2.23.0 |
| generator-jhipsternpm | v < 2.23.0 | 2.23.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.