This vulnerability affects the getSecretKeySaltGenerator function in the Password Hash Handler component of ulisesbocchio jasypt-spring-boot (up to versions 3.0.5 and 4.0.4). It allows an attacker to exploit the use of a one-way hash with a predictable salt, potentially reducing the effectiveness of password hashing. The attack vector is remote with no privileges or user interaction required, but the attack complexity is high. The vulnerability has a CVSS 4.0 base score of 6.3 (medium severity). The project has been informed but has not yet issued a fix or official remediation guidance.

The vulnerability could weaken the cryptographic strength of password hashing by using a predictable salt, potentially aiding attackers in password-related attacks. However, exploitation is difficult due to the high complexity required. There is no indication of privilege escalation, user interaction, or impact on confidentiality, integrity, or availability beyond the weakened hashing mechanism.

No official patch or remediation has been released by the vendor as of the published date. Patch status is not yet confirmed — check the vendor advisory or project repository for current remediation guidance. Until a fix is available, users should consider mitigating risk by avoiding affected versions or implementing additional protective measures around password handling.