PT-2023-32673 · Unknown · Nodejs-Firestore

Abhishek Mathur + 1 · CVE-2023-6460 · Published 2023-12-04 · Updated 2026-05-07

Positive Technologies (AI Summary)

CVSS v3.1

4.0

Medium

Base vector

AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions nodejs-firestore versions prior to 6.1.0

Description A potential logging issue exists within nodejs-firestore, where developers logging objects through this. settings may inadvertently log the firestore key, potentially exposing it to anyone with logs read access.

Recommendations For versions prior to 6.1.0, upgrade to version 6.1.0 to avoid this issue. As a temporary workaround, consider avoiding the logging of objects through this. settings to minimize the risk of exposing the firestore key.

Exploit

Fix

Insertion into Log File

Insecure Storage of Sensitive Information

Weakness Enumeration

CWE-532

CWE-922

Related Identifiers

CVE-2023-6460

GHSA-4G6Q-77J7-VVJC

Affected Products

Nodejs-Firestore

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/6xxx/CVE-2023-6460.json · Exploit
• https://github.com/googleapis/nodejs-firestore/pull/1742 · Patch
• https://osv.dev/vulnerability/CVE-2023-6460 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-6460 · Security Note
• https://osv.dev/vulnerability/GHSA-4g6q-77j7-vvjc · Vendor Advisory
• https://github.com/googleapis/nodejs-firestore · Note
• https://github.com/googleapis/nodejs-firestore/releases/tag/v6.1.0 · Note
• https://t.me/cvenotify/62873 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1731700679821963371 · Twitter Post
• https://twitter.com/CVEnew/status/1731651925475729682 · Twitter Post
• https://t.me/cvenotify/62087 · Telegram Post
• https://bughunters.google.com/reports/vrp/KNvgo1Wij · Note
• https://t.me/cveNotify/162494 · Telegram Post