PT-2023-32673 · Unknown · Nodejs-Firestore

Abhishek Mathur + 1 · Published 2023-12-04 · Updated 2026-05-07 · CVE-2023-6460

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions nodejs-firestore versions prior to 6.1.0

Description A potential logging issue exists within nodejs-firestore, where developers logging objects through this. settings may inadvertently log the firestore key, potentially exposing it to anyone with logs read access.

Recommendations For versions prior to 6.1.0, upgrade to version 6.1.0 to avoid this issue. As a temporary workaround, consider avoiding the logging of objects through this. settings to minimize the risk of exposing the firestore key.

Fix

Insecure Storage of Sensitive Information

Insertion into Log File

Weakness Enumeration

CWE-922

CWE-532

Related Identifiers

CVE-2023-6460

GHSA-4G6Q-77J7-VVJC

Affected Products

Nodejs-Firestore

References · 12

• https://github.com/googleapis/nodejs-firestore/pull/1742 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-6460 · Security Note
• https://osv.dev/vulnerability/CVE-2023-6460 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4g6q-77j7-vvjc · Vendor Advisory
• https://github.com/googleapis/nodejs-firestore/releases/tag/v6.1.0 · Note
• https://github.com/googleapis/nodejs-firestore · Note
• https://t.me/cvenotify/62087 · Telegram Post
• https://twitter.com/CVEnew/status/1731651925475729682 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1731700679821963371 · Twitter Post
• https://bughunters.google.com/reports/vrp/KNvgo1Wij · Note
• https://t.me/cvenotify/62873 · Telegram Post
• https://t.me/cveNotify/162494 · Telegram Post