GHSA-3xc7-xg67-pw99

Source

https://github.com/advisories/GHSA-3xc7-xg67-pw99

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/06/GHSA-3xc7-xg67-pw99/GHSA-3xc7-xg67-pw99.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-3xc7-xg67-pw99

Published

2019-06-05T20:43:10Z

Modified

2021-08-04T20:54:45Z

Severity

3.5 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N CVSS Calculator

Summary

Sensitive Data Exposure in sequelize-cli

Details

Versions of sequelize-cli prior to 5.5.0 are vulnerable to Sensitive Data Exposure. The function filteredURL() does not properly sanitize the config.password value which may cause passwords with special characters to be logged in plain text.

Recommendation

Upgrade to version 5.5.0 or later.

Database specific

{
    "cwe_ids":  [
        "CWE-532"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2019-06-05T20:42:54Z",
    "nvd_published_at":  null,
    "severity":  "LOW"
}

References

Affected packages

npm / sequelize-cli

Package

Name: sequelize-cli; View open source insights on deps.dev
Purl: pkg:npm/sequelize-cli

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Last Affected

5.4.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/06/GHSA-3xc7-xg67-pw99/GHSA-3xc7-xg67-pw99.json"