GitHub Advisoryadvisory · npm

GHSA-4g6q-77j7-vvjc Logging of the firestore key within nodejs-firestore

MEDIUM Published 2023-12-04 Modified 2026-05-08 Official page ↗
Aliases
CVE-2023-6460
Ecosystem
npm
Packages
@google-cloud/firestore
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N
Weaknesses
CWE-532, CWE-922
Reviewed
2023-12-04

Affected packages

• npm @google-cloud/firestore: < 6.1.0 → fixed in 6.1.0

Description

A potential logging of the firestore key via logging within nodejs-firestore exists - Developers who were logging objects through this._settings would be logging the firestore key as well potentially exposing it to anyone with logs read access. We recommend upgrading to version 6.1.0 to avoid this issue

Related

Alias · CVE (1)

  • CVE-2023-6460 A potential logging of the firestore key via logging within nodejs-firestore exists - Developers who were logging objects through… vulnerability

Weakness · CWE (2)

  • CWE-532 Insertion of Sensitive Information into Log File weakness
  • CWE-922 Insecure Storage of Sensitive Information weakness

References