Critical
Security advisory
A class generated by the Generator in JHipster before 6.3.0 and JHipster Kotlin through 1.1.0 produces code that uses an insecure source of randomness (apache.commons.lang3 RandomStringUtils). This allows an attacker (if able to obtain their own password reset URL) to compute the value for all other password resets for other accounts, thus allowing privilege escalation or account takeover.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2019-16303
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 08:37 UTC · Revision 1
Source evidence
A class generated by the Generator in JHipster before 6.3.0 and JHipster Kotlin through 1.1.0 produces code that uses an insecure source of randomness (apache.commons.lang3 RandomStringUtils). This allows an attacker (if able to obtain their own password reset URL) to compute the value for all other password resets for other accounts, thus allowing privilege escalation or account takeover.
osv:CVE-2019-16303
Complete source record
{
"id": "dd04682ef8a83200e5aebde4ce6757ed04a3d27199905c648452510a9366412c",
"url": "https://osv.dev/vulnerability/CVE-2019-16303",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2019-16303",
"summary": "A class generated by the Generator in JHipster before 6.3.0 and JHipster Kotlin through 1.1.0 produces code that uses an insecure source of randomness (apache.commons.lang3 RandomStringUtils). This allows an attacker (if able to obtain their own password reset URL) to compute the value for all other password resets for other accounts, thus allowing privilege escalation or account takeover.",
"evidence": "osv:CVE-2019-16303",
"products": [],
"severity": "critical",
"structured": {
"id": "CVE-2019-16303",
"aliases": [
"CVE-2019-16303",
"GHSA-j3rh-8vwq-wh84",
"GHSA-mwp6-j9wf-968c"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/jhipster/generator-jhipster",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "7772cb116c1b03d35695b161bdd9c89d6e4cd79f"
},
{
"fixed": "88448b85fd3e8e49df103f0061359037c2c68ea7"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:jhipster:jhipster:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "6.3.0"
}
],
"source": "CPE_RANGE"
},
{
"range": [
{
"fixed": "88448b85fd3e8e49df103f0061359037c2c68ea7"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"v6.2.0",
"v6.1.2",
"v6.1.1",
"v6.1.0",
"v6.0.1",
"v6.0.0",
"v6.0.0-beta.0",
"v5.8.1",
"v5.8.0",
"v5.7.2",
"v5.7.1",
"v5.7.0",
"v5.5.0",
"v5.6.0",
"v5.4.2",
"v5.4.1",
"v5.4.0",
"v5.3.4",
"v5.3.3",
"v5.3.2",
"v5.3.1",
"v5.3.0",
"v5.2.1",
"v5.2.0",
"v5.1.0",
"v5.0.2",
"v5.0.1",
"v5.0.0",
"v5.0.0-beta.3",
"v5.0.0-beta.2",
"v5.0.0-beta.1",
"v5.0.0-beta.0",
"v4.14.0",
"v4.13.3",
"v4.13.2",
"v4.13.1",
"v4.13.0",
"v4.12.0",
"v4.11.1",
"v4.11.0",
"v4.10.2",
"v4.10.1",
"v4.10.0",
"v4.9.0",
"v4.8.2",
"v4.8.1",
"v4.8.0",
"v4.7.0",
"v4.6.2",
"v4.6.1",
"v4.6.0",
"v4.5.6",
"v4.5.5",
"v4.5.4",
"v4.5.3",
"v4.5.2",
"v4.5.1",
"v4.5.0",
"v4.4.1",
"v4.4.0",
"v4.3.0",
"v4.2.0",
"v4.1.1",
"v4.1.0",
"v4.0.8",
"v4.0.7",
"v4.0.6",
"v4.0.5",
"v4.0.4",
"v4.0.3",
"v3.12.1",
"v3.12.0",
"v3.11.0",
"v3.10.0",
"v3.9.1",
"v3.9.0",
"v3.8.0",
"v3.7.1",
"v3.7.0",
"v3.4.0",
"v3.3.0",
"v3.2.1",
"v3.2.0",
"v3.1.0",
"v3.0.0",
"v2.27.0",
"v2.26.2",
"v2.26.1",
"v2.26.0",
"v2.25.0",
"v2.24.0",
"v2.23.1",
"v2.23.0",
"v2.22.0",
"v2.21.1",
"v2.21.0",
"v2.20.0",
"v2.11.1",
"v2.19.0",
"v2.17.0",
"v2.16.1",
"v2.16.0",
"v2.15.2",
"v2.15.1",
"v2.15.0",
"v2.13.1",
"v2.13.0",
"v2.12.0",
"v2.11.0",
"v2.10.1",
"v2.10.0",
"v2.9.2",
"v2.9.1",
"v2.9.0",
"v2.8.0",
"v2.7.0",
"v2.6.0",
"v2.5.2",
"v2.5.1",
"v2.5.0",
"v2.4.0",
"v2.2.0",
"v2.1.1",
"v2.1.0",
"v2.0.0",
"v1.8.1",
"v1.8.0",
"v1.7.1",
"v1.7.0",
"v1.5.0",
"v1.4.0",
"v1.3.0",
"v1.2.2",
"v1.2.1",
"v1.2.0",
"v1.1.1",
"v1.1.0",
"v1.0.0",
"v0.18.1",
"v0.18.0",
"v0.17.2",
"v0.17.1",
"v0.17.0",
"v0.16.0",
"v0.15.0",
"v0.14.0",
"v0.13.0",
"v0.11.0",
"v0.10.1",
"v0.10.0",
"v0.9.3",
"v0.9.2",
"v0.9.1",
"v0.9.0",
"v0.8.4",
"v0.8.3",
"v0.8.2",
"v0.8.1",
"v0.8.0",
"v0.7.1",
"v0.7.0",
"v0.6.2",
"v0.6.1",
"v0.6.0",
"v0.5.2",
"v0.5.1",
"v0.5.0",
"v0.4.0",
"v0.3.1"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-16303.json"
}
},
{
"ranges": [
{
"repo": "https://github.com/jhipster/jhipster-kotlin",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"last_affected": "140c996ec88d23dea9d366d1ec8c473b0d043c9b"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:jhipster:jhipster_kotlin:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"last_affected": "1.1.0"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"1.1.0",
"1.0.0",
"0.8.1",
"0.8.0",
"0.7.0",
"0.6.1",
"0.6.0",
"0.5.0",
"0.4.0",
"0.3.0",
"0.2.1",
"0.2.0",
"0.1.0",
"0.0.9",
"0.0.8",
"0.0.7",
"0.0.6",
"0.0.5",
"0.0.3",
"0.0.2",
"0.0.1"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-16303.json"
}
}
],
"modified": "2026-10-24T10:47:43.155400564Z",
"provider": "osv",
"references": [
"https://lists.apache.org/thread.html/r6d243e7e3f25daeb242dacf3def411fba32a9388d3ff84918cb28ddd%40%3Cissues.commons.apache.org%3E",
"https://lists.apache.org/thread.html/rc3f00f5d3d2ec0e2381a3b9096d5f5b4d46ec1587ee7e251a3dbb897%40%3Cissues.commons.apache.org%3E",
"https://lists.apache.org/thread.html/rc87fa35a48b5d70b06af6fb81785ed82e82686eb83307aae6d250dc9%40%3Cissues.commons.apache.org%3E",
"https://github.com/jhipster/generator-jhipster/security/advisories/GHSA-mwp6-j9wf-968c",
"https://www.jhipster.tech/2019/09/13/jhipster-release-6.3.0.html",
"https://github.com/jhipster/generator-jhipster/issues/10401",
"https://github.com/jhipster/jhipster-kotlin/issues/183",
"https://github.com/jhipster/generator-jhipster/commit/88448b85fd3e8e49df103f0061359037c2c68ea7"
],
"provider_metadata": {}
},
"related_cves": [
{
"value": "CVE-2019-16303",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 441495,
"published_at": "2019-09-14T00:15:10.39+00:00"
}