Detections
Analytics

SCA: security update for generator-jhipster (GHSA-cmm8-gw4m-26cw)

high Tenable Self-Hosted Container Security Plugin ID 428646

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - JHipster before v.8.9.0 allows privilege escalation via a modified authorities parameter. Upon registering
 in the JHipster portal and logging in as a standard user, the authorities parameter in the response from
 the api/account endpoint contains the value ROLE_USER. By manipulating the authorities parameter and
 changing its value to ROLE_ADMIN, the privilege is successfully escalated to an Admin level. This allowed
 the access to all admin-related functionalities in the application. NOTE: this is disputed by the Supplier
 because there is no privilege escalation in the context of the JHipster backend (the report only
 demonstrates that, after using JHipster to generate an application, one can make a non-functional admin
 screen visible in the front end of that application). (CVE-2025-43712)

See Also

https://github.com/advisories/GHSA-cmm8-gw4m-26cw

Plugin Details

Severity: High

ID: 428646

Version: Revision 1.7

Type: Local

Family: SCA Checks

Published: 7/29/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 57.49

Vendor

Vendor Severity: Low

CVSS v2

Risk Factor: Low

Base Score: 1.2

Temporal Score: 0.9

Vector: CVSS2#AV:L/AC:H/Au:N/C:N/I:P/A:N

CVSS Score Source: CVE-2025-43712

CVSS v3

Risk Factor: High

Base Score: 8

Temporal Score: 7

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 7/25/2025

Vulnerability Publication Date: 7/25/2025

Reference Information

CVE: CVE-2025-43712