PT-2019-19997 · Sequelize · Sequelize-Cli

Publicado 2019-06-05 · Atualizado 2019-06-05

Positive Technologies (AI Summary)

CVSS v3.1

3.5

Baixa

Vetor base

AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions sequelize-cli versions prior to 5.5.0

Description The issue concerns Sensitive Data Exposure. The function filteredURL() does not properly sanitize the config.password value, which may cause passwords with special characters to be logged in plain text.

Recommendations For versions prior to 5.5.0, upgrade to version 5.5.0 or later.

Correção

Insertion into Log File

Enumeração de Fraquezas

CWE-532

Identificadores relacionados

GHSA-3XC7-XG67-PW99

Produtos afetados

Sequelize-Cli

Referências · 6

• https://github.com/sequelize/cli/issues/172 · Nota
• https://github.com/sequelize/cli/pull/722 · Nota
• https://npmjs.com/advisories/825 · Nota
• https://github.com/FelixLC/cli/commit/da59652c061a798282e18efad0b6d0afefa15465 · Nota
• https://snyk.io/vuln/SNYK-JS-SEQUELIZECLI-174320 · Nota
• https://osv.dev/vulnerability/GHSA-3xc7-xg67-pw99 · Aviso do Fabricante