QID 983181
QID 983181: Nodejs (npm) Security Update for generator-jhipster-kotlin (GHSA-pfxf-wh96-fvjc)
Security update has been released for generator-jhipster-kotlin to fix the vulnerability.
Note: The preceding description block is extracted directly from the security advisory. Using automation, we have attempted to clean and format it as much as possible without introducing additional issues.
We log the mail for invalid password reset attempts.
As the email is provided by a user and the api is public this can be used by an attacker to forge log entries.
This is vulnerable to https://cwe.mitre.org/data/definitions/117.html
This problem affects only application generated with jwt or session authentication. Applications using oauth are not vulnerable.
Solution
version 1.7.0.Workaround:
In `AccountResource.kt` you should change the line
```kotlin
log.warn("Password reset requested for non existing mail '$mail'");
```
to
```kotlin
log.warn("Password reset requested for non existing mail");
```
In `AccountResource.kt` you should change the line
```kotlin
log.warn("Password reset requested for non existing mail '$mail'");
```
to
```kotlin
log.warn("Password reset requested for non existing mail");
```
Vendor References
- GHSA-pfxf-wh96-fvjc -
github.com/advisories/GHSA-pfxf-wh96-fvjc
CVEs related to QID 983181
Software Advisories
| Advisory ID | Software | Component | Link |
|---|---|---|---|
| GHSA-pfxf-wh96-fvjc | generator-jhipster-kotlin |
github.com/advisories/GHSA-pfxf-wh96-fvjc |