GitHub Advisoryadvisory · npm

GHSA-2xwv-3cc9-fp7c Sensitive Data Exposure in seneca

LOW Published 2019-09-11 Modified 2020-08-31 Official page ↗
Aliases
CVE-2019-5483
Ecosystem
npm
Packages
seneca
Severity
Low
Weaknesses
CWE-209
Reviewed
2019-09-11

Affected packages

• npm seneca: < 3.9.0 → fixed in 3.9.0

Description

Versions of `seneca` prior to 3.9.0 are vulnerable to Sensitive Data Exposure. When a process using the package crashes all environment variables are printed. This may leak sensitive data such as access keys, especially given scenarios when log-monitoring systems store the error output. Recommendation Upgrade to version 3.9.0 or later.

Related

Alias · CVE (1)

  • CVE-2019-5483 Seneca < 3.9.0 contains a vulnerability that could lead to exposing environment variables to unauthorized users. vulnerability

Weakness · CWE (1)

  • CWE-209 Generation of Error Message Containing Sensitive Information weakness

References