CVE-2019-16303

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2019-09-14 · updated 2026-06-17
Weakness: CWE-338

Description

A class generated by the Generator in JHipster before 6.3.0 and JHipster Kotlin through 1.1.0 produces code that uses an insecure source of randomness (apache.commons.lang3 RandomStringUtils). This allows an attacker (if able to obtain their own password reset URL) to compute the value for all other password resets for other accounts, thus allowing privilege escalation or account takeover.

Affected products

Jhipster: before 6.3.0 — fixed in 6.3.0
Jhipster Kotlin: through 1.1.0

How to fix

Upgrade to a fixed version: Jhipster 6.3.0. Check the vendor advisory for mitigations.

References

https://github.com/jhipster/generator-jhipster/commit/88448b85fd3e8e49df103f0061359037c2c68ea7
https://github.com/jhipster/generator-jhipster/issues/10401
https://github.com/jhipster/generator-jhipster/security/advisories/GHSA-mwp6-j9wf-968c
https://github.com/jhipster/jhipster-kotlin/issues/183
https://lists.apache.org/thread.html/r6d243e7e3f25daeb242dacf3def411fba32a9388d3ff84918cb28ddd%40%3Cissues.commons.apache.org%3E
https://lists.apache.org/thread.html/rc3f00f5d3d2ec0e2381a3b9096d5f5b4d46ec1587ee7e251a3dbb897%40%3Cissues.commons.apache.org%3E
https://lists.apache.org/thread.html/rc87fa35a48b5d70b06af6fb81785ed82e82686eb83307aae6d250dc9%40%3Cissues.commons.apache.org%3E
https://www.jhipster.tech/2019/09/13/jhipster-release-6.3.0.html
https://github.com/jhipster/generator-jhipster/commit/88448b85fd3e8e49df103f0061359037c2c68ea7
https://github.com/jhipster/generator-jhipster/issues/10401
https://github.com/jhipster/generator-jhipster/security/advisories/GHSA-mwp6-j9wf-968c
https://github.com/jhipster/jhipster-kotlin/issues/183

Get alerted when CVE-2019-16303 or the next vulnerability affects your stack