{"id":"CVE-2019-16303","aliases":["EUVD-2020-0493","GHSA-j3rh-8vwq-wh84","GHSA-mwp6-j9wf-968c"],"status":"published","title":"JHipster Kotlin using insecure source of randomness `RandomStringUtils` before v1.2.0","description":"A class generated by the Generator in JHipster before 6.3.0 and JHipster Kotlin through 1.1.0 produces code that uses an insecure source of randomness (apache.commons.lang3 RandomStringUtils). This allows an attacker (if able to obtain their own password reset URL) to compute the value for all other password resets for other accounts, thus allowing privilege escalation or account takeover.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.03673,"percentile":0.89743,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-338"],"published":"2019-09-13T21:33:25Z","modified":"2026-10-24T10:47:43Z","fixes":[{"ecosystem":"npm","package":"generator-jhipster-kotlin","fixed_in":["1.2.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"generator-jhipster-kotlin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0"}]}]},{"source":"osv","ecosystem":"npm","package":"generator-jhipster-kotlin","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.2.0"}]}]}],"products":[{"vendor":"jhipster","product":"jhipster"},{"vendor":"jhipster","product":"jhipster_kotlin"}],"references":[{"url":"https://github.com/jhipster/generator-jhipster/security/advisories/GHSA-mwp6-j9wf-968c","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://github.com/jhipster/generator-jhipster/issues/10401","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Third Party Advisory","report","web"]},{"url":"https://github.com/jhipster/generator-jhipster/commit/88448b85fd3e8e49df103f0061359037c2c68ea7","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://github.com/jhipster/jhipster-kotlin/issues/183","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Third Party Advisory","report","web"]},{"url":"https://www.jhipster.tech/2019/09/13/jhipster-release-6.3.0.html","tags":["x_refsource_MISC","x_transferred","Release Notes","Vendor Advisory","advisory","web"]},{"url":"https://lists.apache.org/thread.html/r6d243e7e3f25daeb242dacf3def411fba32a9388d3ff84918cb28ddd%40%3Cissues.commons.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rc87fa35a48b5d70b06af6fb81785ed82e82686eb83307aae6d250dc9%40%3Cissues.commons.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rc3f00f5d3d2ec0e2381a3b9096d5f5b4d46ec1587ee7e251a3dbb897%40%3Cissues.commons.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://github.com/jhipster/jhipster-kotlin/security/advisories/GHSA-j3rh-8vwq-wh84","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-16303","tags":["advisory"]},{"url":"https://snyk.io/vuln/SNYK-JS-GENERATORJHIPSTER-466980","tags":["web"]},{"url":"https://www.npmjs.com/advisories/1187","tags":["web"]},{"url":"https://www.npmjs.com/advisories/1188","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r6d243e7e3f25daeb242dacf3def411fba32a9388d3ff84918cb28ddd@%3Cissues.commons.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/rc3f00f5d3d2ec0e2381a3b9096d5f5b4d46ec1587ee7e251a3dbb897@%3Cissues.commons.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/rc87fa35a48b5d70b06af6fb81785ed82e82686eb83307aae6d250dc9@%3Cissues.commons.apache.org%3E","tags":["web"]},{"url":"https://github.com/jhipster/jhipster-kotlin/commit/deec3587ef7721cf5de5b960d43e9b68beff6193","tags":["web"]},{"url":"https://github.com/advisories/GHSA-j3rh-8vwq-wh84","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-mwp6-j9wf-968c","tags":["advisory"]},{"url":"https://github.com/jhipster/generator-jhipster","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2019-16303","description":"A class generated by the Generator in JHipster before 6.3.0 and JHipster Kotlin through 1.1.0 produces code that uses an insecure source of randomness (apache.commons.lang3 RandomStringUtils). This allows an attacker (if able to obtain their own password reset URL) to compute the value for all other password resets for other accounts, thus allowing privilege escalation or account takeover.","status":"published","published":"2019-09-13T23:43:41Z","modified":"2024-08-05T01:10:41.654Z","updated_at":"2026-11-02T14:32:23.189113Z"}],"euvd":[{"id":"EUVD-2020-0493","description":"A class generated by the Generator in JHipster before 6.3.0 and JHipster Kotlin through 1.1.0 produces code that uses an insecure source of randomness (apache.commons.lang3 RandomStringUtils). This allows an attacker (if able to obtain their own password reset URL) to compute the value for all other password resets for other accounts, thus allowing privilege escalation or account takeover.","status":"published","published":"2019-09-13T23:43:41Z","modified":"2024-08-05T01:10:41Z","updated_at":"2026-11-03T02:40:33.179924Z"}],"ghsa":[{"id":"GHSA-j3rh-8vwq-wh84","title":"JHipster Kotlin using insecure source of randomness `RandomStringUtils` before v1.2.0","description":"JHipster Kotlin is using an insecure source of randomness to generate all of its random values. JHipster Kotlin relies upon apache commons lang3 `RandomStringUtils`.\n\nFrom the documentation:\n\n\u003e Caveat: Instances of Random, upon which the implementation of this class relies, are not cryptographically secure.\n\u003e \\- https://commons.apache.org/proper/commons-lang/javadocs/api-3.9/org/apache/commons/lang3/RandomStringUtils.html\n\nHere are the examples of JHipster Kotlin's use of an insecure PRNG:\n\nhttps://github.com/jhipster/jhipster-kotlin/blob/193ae8f13c0be686f9687e78bacfedb144c47d8c/generators/server/templates/src/main/kotlin/package/service/util/RandomUtil.kt.ejs#L32\n\n## Proof Of Concepts Already Exist\n\nThere has been a POC of taking one RNG value generated `RandomStringUtils` and reversing it to generate all of the past/future RNG values public since March 3rd, 2018.\n\nhttps://medium.com/@alex91ar/the-java-soothsayer-a-practical-application-for-insecure-randomness-c67b0cd148cd\n\nPOC Repository: https://github.com/alex91ar/randomstringutils\n\n\n## Potential Impact Technical\n\nAll that is required is to get one password reset token from a JHipster Kotlin generated service and using the POC above, you can reverse what all future password reset tokens to be generated by this server. This allows an attacker to pick and choose what account they would like to takeover by sending account password reset requests for targeted accounts.\n\n## Potential Impact Scale\n\nNot as large as for the original jhipster project as the kotlin blueprint is not that widely used.\n\n### Patches\n\nUpdate your generated applications to \u003e 1.2.0\n\n### Workarounds\n\nChange the content of `RandomUtil.kt` like this:\n\n```kotlin\nimport java.security.SecureRandom\nimport org.apache.commons.lang3.RandomStringUtils\n\nprivate const val DEF_COUNT = 20\n\nobject RandomUtil {\n    private val secureRandom: SecureRandom = SecureRandom()\n\n    init {\n        secureRandom.nextBytes(byteArrayOf(64.toByte()))\n    }\n\n    private fun generateRandomAlphanumericString(): String {\n        return RandomStringUtils.random(DEF_COUNT, 0, 0, true, true, null, secureRandom)\n    }\n\n    /**\n    * Generate a password.\n    *\n    * @return the generated password.\n    */\n    fun generatePassword(): String = generateRandomAlphanumericString()\n}\n```\n\nImportant is to exchange **every** call of `RandomStringUtils.randomAlphaNumeric`.\n\n\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n* Open an issue in [JHipster Kotlin](https://github.com/jhipster/jhipster-kotlin)","status":"published","published":"2020-06-26T16:48:13Z","modified":"2023-01-20T18:53:27Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-338"],"updated_at":"2026-11-02T14:36:14.033357Z"},{"id":"GHSA-mwp6-j9wf-968c","title":"Critical severity vulnerability that affects generator-jhipster","description":"Account takeover and privilege escalation is possible in applications generated by generator-jhipster before 6.3.0. This is due to a vulnerability in the generated java classes: CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)\n\nGenerated applications must be manually patched, following instructions in the release notes: https://www.jhipster.tech/2019/09/13/jhipster-release-6.3.0.html\n","status":"withdrawn","published":"2019-09-13T21:33:25Z","modified":"2023-01-09T05:03:09Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-338"],"updated_at":"2026-11-02T14:36:04.396827Z"}],"nvd":[{"id":"CVE-2019-16303","description":"A class generated by the Generator in JHipster before 6.3.0 and JHipster Kotlin through 1.1.0 produces code that uses an insecure source of randomness (apache.commons.lang3 RandomStringUtils). This allows an attacker (if able to obtain their own password reset URL) to compute the value for all other password resets for other accounts, thus allowing privilege escalation or account takeover.","status":"published","published":"2019-09-14T00:15:10.39Z","modified":"2026-06-17T02:22:05.957Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-338"],"updated_at":"2026-11-02T14:05:28.126831Z"}],"osv":[{"id":"CVE-2019-16303","description":"A class generated by the Generator in JHipster before 6.3.0 and JHipster Kotlin through 1.1.0 produces code that uses an insecure source of randomness (apache.commons.lang3 RandomStringUtils). This allows an attacker (if able to obtain their own password reset URL) to compute the value for all other password resets for other accounts, thus allowing privilege escalation or account takeover.","status":"published","published":"2019-09-14T00:15:10.39Z","modified":"2026-10-24T10:47:43.155400564Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:11.361782Z"},{"id":"GHSA-j3rh-8vwq-wh84","title":"JHipster Kotlin using insecure source of randomness `RandomStringUtils` before v1.2.0","description":"JHipster Kotlin is using an insecure source of randomness to generate all of its random values. JHipster Kotlin relies upon apache commons lang3 `RandomStringUtils`.\n\nFrom the documentation:\n\n\u003e Caveat: Instances of Random, upon which the implementation of this class relies, are not cryptographically secure.\n\u003e \\- https://commons.apache.org/proper/commons-lang/javadocs/api-3.9/org/apache/commons/lang3/RandomStringUtils.html\n\nHere are the examples of JHipster Kotlin's use of an insecure PRNG:\n\nhttps://github.com/jhipster/jhipster-kotlin/blob/193ae8f13c0be686f9687e78bacfedb144c47d8c/generators/server/templates/src/main/kotlin/package/service/util/RandomUtil.kt.ejs#L32\n\n## Proof Of Concepts Already Exist\n\nThere has been a POC of taking one RNG value generated `RandomStringUtils` and reversing it to generate all of the past/future RNG values public since March 3rd, 2018.\n\nhttps://medium.com/@alex91ar/the-java-soothsayer-a-practical-application-for-insecure-randomness-c67b0cd148cd\n\nPOC Repository: https://github.com/alex91ar/randomstringutils\n\n\n## Potential Impact Technical\n\nAll that is required is to get one password reset token from a JHipster Kotlin generated service and using the POC above, you can reverse what all future password reset tokens to be generated by this server. This allows an attacker to pick and choose what account they would like to takeover by sending account password reset requests for targeted accounts.\n\n## Potential Impact Scale\n\nNot as large as for the original jhipster project as the kotlin blueprint is not that widely used.\n\n### Patches\n\nUpdate your generated applications to \u003e 1.2.0\n\n### Workarounds\n\nChange the content of `RandomUtil.kt` like this:\n\n```kotlin\nimport java.security.SecureRandom\nimport org.apache.commons.lang3.RandomStringUtils\n\nprivate const val DEF_COUNT = 20\n\nobject RandomUtil {\n    private val secureRandom: SecureRandom = SecureRandom()\n\n    init {\n        secureRandom.nextBytes(byteArrayOf(64.toByte()))\n    }\n\n    private fun generateRandomAlphanumericString(): String {\n        return RandomStringUtils.random(DEF_COUNT, 0, 0, true, true, null, secureRandom)\n    }\n\n    /**\n    * Generate a password.\n    *\n    * @return the generated password.\n    */\n    fun generatePassword(): String = generateRandomAlphanumericString()\n}\n```\n\nImportant is to exchange **every** call of `RandomStringUtils.randomAlphaNumeric`.\n\n\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n* Open an issue in [JHipster Kotlin](https://github.com/jhipster/jhipster-kotlin)","status":"published","published":"2020-06-26T16:48:13Z","modified":"2026-07-08T06:49:46.78724556Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-338"],"updated_at":"2026-11-02T15:46:49.977351Z"},{"id":"GHSA-mwp6-j9wf-968c","title":"Critical severity vulnerability that affects generator-jhipster","description":"Account takeover and privilege escalation is possible in applications generated by generator-jhipster before 6.3.0. This is due to a vulnerability in the generated java classes: CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)\n\nGenerated applications must be manually patched, following instructions in the release notes: https://www.jhipster.tech/2019/09/13/jhipster-release-6.3.0.html\n","status":"withdrawn","published":"2019-09-13T21:33:25Z","modified":"2026-09-10T03:48:45.080518332Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-338"],"updated_at":"2026-11-02T15:46:52.534897Z"}]}}