medium4.0
CVE-2023-6460
Logging of the firestore key within nodejs-firestore
Impact
A potential logging of the firestore key via logging within nodejs-firestore exists - Developers who were logging objects through this._settings would be logging the firestore key as well potentially exposing it to anyone with logs read access. We recommend upgrading to version 6.1.0 to avoid this issue
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | @google-cloud/firestore | < 6.1.0 | 6.1.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Cloud Firestore | before 6.1.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://bughunters.google.com/reports/vrp/KNvgo1Wij
- https://github.com/googleapis/nodejs-firestore/pull/1742
- https://github.com/advisories/GHSA-4g6q-77j7-vvjc
- https://nvd.nist.gov/vuln/detail/CVE-2023-6460
- https://github.com/googleapis/nodejs-firestore/releases/tag/v6.1.0