CVE-2020-4072

描述

### Impact We log the mail for invalid password reset attempts. As the email is provided by a user and the api is public this can be used by an attacker to forge log entries. This is vulnerable to https://cwe.mitre.org/data/definitions/117.html This problem affects only application generated with jwt or session authentication. Applications using oauth are not vulnerable. ### Patches version 1.7.0. ### Workarounds In `AccountResource.kt` you should change the line ```kotlin log.warn("Password reset requested for non existing mail '$mail'"); ``` to ```kotlin log.warn("Password reset requested for non existing mail"); ``` ### References * https://cwe.mitre.org/data/definitions/117.html * https://owasp.org/www-community/attacks/Log_Injection * https://www.baeldung.com/jvm-log-forging ### For more information If you have any questions or comments about this advisory: * Open an issue in [jhipster kotlin](https://github.com/jhipster/jhipster-kotlin)

如何修補 CVE-2020-4072

要修補 CVE-2020-4072,請將受影響套件升級到下列已修補版本。

• —升級至 1.7.0 或更新版本

CVE-2020-4072 正在被利用嗎?

低 — EPSS 為 1.2%,目前沒有觀察到大規模利用活動。

受影響套件(1)

• >= 1.6.0, < 1.7.0

CVSS 分數

參考連結(5)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2020-4072
• WEBgithub.com/jhipster/jhipster-kotlin/commit/426ccab85e7e0da562643200637b99b6a2a99449
• WEBgithub.com/jhipster/jhipster-kotlin/security/advisories/GHSA-pfxf-wh96-fvjc
• WEBowasp.org/www-community/attacks/Log_Injection