High severity vulnerability that affects generator-jhipster
Generated code uses repository configuration that downloads over HTTP instead of HTTPS
Impact
Gradle users were using the http://repo.spring.io/plugins-release repositories in plain HTTP, and not HTTPS, so a man-in-the-middle attack was possible at build time.
Patches
Maven users should at least upgrade to 6.3.0 while Gradle users should update to 6.3.1.
If you are not able to upgrade make sure not to use a Maven repository via http in your build file.
Workarounds
Replace all custom repository definitions in build.gradle or pom.xml with their https version.
e.g.
<repository>
<id>oss.sonatype.org-snapshot</id>
<url>https://oss.sonatype.org/content/repositories/snapshots</url> // <-- must be httpS
<releases>
<enabled>false</enabled>
</releases>
<snapshots>
<enabled>true</enabled>
</snapshots>
</repository>maven { url "https://repo.spring.io/plugins-release" } // <-- must be httpSReferences
- https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- https://max.computer/blog/how-to-take-over-the-computer-of-any-java-or-clojure-or-scala-developer/
For more information
If you have any questions or comments about this advisory:
- Open an issue in https://github.com/jhipster/generator-jhipster/issues
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | generator-jhipster | < 6.3.1 | 6.3.1 |
References
- CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H- Weakness (CWE)
CWE-494, CWE-829- Platform
- npm
- Package
generator-jhipster- Disclosed
- 23.09.2019
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-mc84-xr9p-938r - CC BY 4.0
Vulnerability history: generator-jhipster
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 5
- First → latest
- 09.2019 10.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- High 5
Disclosures per year
- 2019: 1
- 2020: 0
- 2021: 0
- 2022: 1
- 2023: 1
- 2024: 0
- 2025: 0
- 2026: 2
-
High severity vulnerability that affects generator-jhipster this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.