{"action":"Upgrade generator-jhipster to 2.23.0 or later.","affected":[{"fixed":"2.23.0","introduced":"0"}],"component":"generator-jhipster","cve_ids":["CVE-2015-20110"],"ecosystem":"npm","epss":0.00593,"exploited":false,"fixed_versions":["2.23.0"],"ghsa_id":"GHSA-4gpm-r23h-gprw","id":"tcs_01M5KF0EBM95V7CK2R50SYFM4M","modified_at":"2023-11-08T18:41:14Z","published_at":"2023-10-31T03:31:22Z","references":["https://osv.dev/vulnerability/GHSA-4gpm-r23h-gprw","https://nvd.nist.gov/vuln/detail/CVE-2015-20110","https://github.com/jhipster/generator-jhipster/issues/2095","https://github.com/jhipster/generator-jhipster/commit/79fe5626cb1bb80f9ac86cf46980748e65d2bdbc","https://github.com/jhipster/generator-jhipster/commit/7c49ab3d45dc4921b831a2ca55fb1e2a2db1ee25","https://github.com/jhipster/generator-jhipster","https://github.com/jhipster/generator-jhipster/compare/v2.22.0...v2.23.0"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-4gpm-r23h-gprw","url":"https://osv.dev/vulnerability/GHSA-4gpm-r23h-gprw"}],"summary":"generator-jhipster allows a timing attack against validateToken due to a string comparison that stops at the first character"}