GitHub Advisoryadvisory · npm

GHSA-3xc7-xg67-pw99 Sensitive Data Exposure in sequelize-cli

LOW Published 2019-06-05 Modified 2021-08-04 Official page ↗
Ecosystem
npm
Packages
sequelize-cli
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
Weaknesses
CWE-532
Reviewed
2019-06-05

Affected packages

• npm sequelize-cli: <= 5.4.0 (no fix yet)

Description

Versions of `sequelize-cli` prior to 5.5.0 are vulnerable to Sensitive Data Exposure. The function `filteredURL()` does not properly sanitize the `config.password` value which may cause passwords with special characters to be logged in plain text. Recommendation Upgrade to version 5.5.0 or later.

Related

Weakness · CWE (1)

  • CWE-532 Insertion of Sensitive Information into Log File weakness

References