CVE-2023-6460CWE-922

Information leak in nodejs-firestore

Medium · published December 4, 2023

CVSS v3.1
4.0
EPSS
0%
Percentile
1.8
In the wild
Unconfirmed
What it is

A potential logging of the firestore key via logging within nodejs-firestore exists - Developers who were logging objects through this._settings would be logging the firestore key as well potentially exposing it to anyone with logs read access. We recommend upgrading to version 6.1.0 to avoid this issue

The record
Technical detail
CVSS v3.1
4.0 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00122 · 1.8th percentile
Weakness
CWE-922 · Insecure Storage of Sensitive Information
Published
2023-12-04T12:26Z
EPSS history
Timeline
  • 04 DEC 12:26Z
    Information leak in nodejs-firestore
    cvelistv5