CVE-2015-20110 generator-jhipster allows a timing attack against validateToken due to a string comparison that stops at the first character
HighCVSS 7.5
EPSS 0.73%
- Published
- Updated
- Exploit status
- No public exploit known
Description
JHipster generator-jhipster before 2.23.0 allows a timing attack against validateToken due to a string comparison that stops at the first character that is different. Attackers can guess tokens by brute forcing one character at a time and observing the timing. This of course drastically reduces the search space to a linear amount of guesses based on the token length times the possible characters.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| npm generator-jhipster(npm) | < 2.23.0 | 2.23.0 |
| jhipster | < 2.23.0 | 2.23.0 |
References
- nvd.nist.gov third-party-advisory
- github.com issue-tracking patch vendor-advisory
- github.com patch
- github.com patch
- github.com patch release-notes
- github.com