{"id":"CVE-2015-20110","aliases":["EUVD-2023-2645","GHSA-4gpm-r23h-gprw"],"status":"published","title":"generator-jhipster allows a timing attack against validateToken due to a string comparison that stops at the first character","description":"JHipster generator-jhipster before 2.23.0 allows a timing attack against validateToken due to a string comparison that stops at the first character that is different. Attackers can guess tokens by brute forcing one character at a time and observing the timing. This of course drastically reduces the search space to a linear amount of guesses based on the token length times the possible characters.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.00732,"percentile":0.54553,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-208","CWE-307"],"published":"2023-10-31T00:00:00Z","modified":"2026-06-17T00:23:24Z","fixes":[{"ecosystem":"npm","package":"generator-jhipster","fixed_in":["2.23.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"generator-jhipster","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.23.0"}]}]},{"source":"osv","ecosystem":"npm","package":"generator-jhipster","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.23.0"}]}]}],"products":[{"vendor":"jhipster","product":"jhipster"}],"references":[{"url":"https://github.com/jhipster/generator-jhipster/issues/2095","tags":["x_transferred","Issue Tracking","Patch","Vendor Advisory","web"]},{"url":"https://github.com/jhipster/generator-jhipster/commit/7c49ab3d45dc4921b831a2ca55fb1e2a2db1ee25","tags":["x_transferred","Patch","web"]},{"url":"https://github.com/jhipster/generator-jhipster/commit/79fe5626cb1bb80f9ac86cf46980748e65d2bdbc","tags":["x_transferred","Patch","web"]},{"url":"https://github.com/jhipster/generator-jhipster/compare/v2.22.0...v2.23.0","tags":["x_transferred","Patch","Release Notes","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-20110","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-4gpm-r23h-gprw"},{"url":"https://github.com/jhipster/generator-jhipster","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2015-20110","description":"JHipster generator-jhipster before 2.23.0 allows a timing attack against validateToken due to a string comparison that stops at the first character that is different. Attackers can guess tokens by brute forcing one character at a time and observing the timing. This of course drastically reduces the search space to a linear amount of guesses based on the token length times the possible characters.","status":"published","published":"2023-10-31T00:00:00Z","modified":"2024-09-06T18:28:17.077Z","updated_at":"2026-11-02T14:35:39.447402Z"}],"euvd":[{"id":"EUVD-2023-2645","description":"JHipster generator-jhipster before 2.23.0 allows a timing attack against validateToken due to a string comparison that stops at the first character that is different. Attackers can guess tokens by brute forcing one character at a time and observing the timing. This of course drastically reduces the search space to a linear amount of guesses based on the token length times the possible characters.","status":"published","published":"2023-10-31T00:00:00Z","modified":"2024-09-06T18:28:17Z","updated_at":"2026-11-03T00:56:01.652315Z"}],"ghsa":[{"id":"GHSA-4gpm-r23h-gprw","title":"generator-jhipster allows a timing attack against validateToken due to a string comparison that stops at the first character","description":"JHipster generator-jhipster before 2.23.0 allows a timing attack against validateToken due to a string comparison that stops at the first character that is different. Attackers can guess tokens by brute forcing one character at a time and observing the timing. This of course drastically reduces the search space to a linear amount of guesses based on the token length times the possible characters.","status":"published","published":"2023-10-31T03:31:22Z","modified":"2023-11-17T05:04:33Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-208","CWE-307"],"updated_at":"2026-11-02T14:37:22.040291Z"}],"nvd":[{"id":"CVE-2015-20110","description":"JHipster generator-jhipster before 2.23.0 allows a timing attack against validateToken due to a string comparison that stops at the first character that is different. Attackers can guess tokens by brute forcing one character at a time and observing the timing. This of course drastically reduces the search space to a linear amount of guesses based on the token length times the possible characters.","status":"published","published":"2023-10-31T03:15:07.613Z","modified":"2026-06-17T00:23:24.503Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"}],"cwes":["CWE-307"],"updated_at":"2026-11-02T14:03:20.037729Z"}],"osv":[{"id":"GHSA-4gpm-r23h-gprw","title":"generator-jhipster allows a timing attack against validateToken due to a string comparison that stops at the first character","description":"JHipster generator-jhipster before 2.23.0 allows a timing attack against validateToken due to a string comparison that stops at the first character that is different. Attackers can guess tokens by brute forcing one character at a time and observing the timing. This of course drastically reduces the search space to a linear amount of guesses based on the token length times the possible characters.","status":"published","published":"2023-10-31T03:31:22Z","modified":"2023-11-08T18:41:14Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-208","CWE-307"],"updated_at":"2026-11-02T15:46:37.148947Z"}]}}