PT-2023-32673 · Unknown · Nodejs-Firestore

Abhishek Mathur + 1 · Publicado 2023-12-04 · Atualizado 2026-05-07 · CVE-2023-6460

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Média

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions nodejs-firestore versions prior to 6.1.0

Description A potential logging issue exists within nodejs-firestore, where developers logging objects through this. settings may inadvertently log the firestore key, potentially exposing it to anyone with logs read access.

Recommendations For versions prior to 6.1.0, upgrade to version 6.1.0 to avoid this issue. As a temporary workaround, consider avoiding the logging of objects through this. settings to minimize the risk of exposing the firestore key.

Correção

Insecure Storage of Sensitive Information

Insertion into Log File

Enumeração de Fraquezas

CWE-922

CWE-532

Identificadores relacionados

CVE-2023-6460

GHSA-4G6Q-77J7-VVJC

Produtos afetados

Nodejs-Firestore

Referências · 12

• https://github.com/googleapis/nodejs-firestore/pull/1742 · Correção
• https://github.com/googleapis/nodejs-firestore/releases/tag/v6.1.0 · Nota
• https://github.com/googleapis/nodejs-firestore · Nota
• https://t.me/cvenotify/62087 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-6460 · Nota de Segurança
• https://twitter.com/CVEnew/status/1731651925475729682 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2023-6460 · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/1731700679821963371 · Publicação no Twitter
• https://bughunters.google.com/reports/vrp/KNvgo1Wij · Nota
• https://osv.dev/vulnerability/GHSA-4g6q-77j7-vvjc · Aviso do Fabricante
• https://t.me/cvenotify/62873 · Publicação no Telegram
• https://t.me/cveNotify/162494 · Publicação no Telegram