GHSA-3xc7-xg67-pw99 Sensitive Data Exposure in sequelize-cli
Attackers can view database passwords in plain text logs due to improper sanitization in sequelize-cli.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Not stated
- Victim action needed
- Not needed
- Fix
- None listed
What is GHSA-3xc7-xg67-pw99?
GHSA-3xc7-xg67-pw99 is a vulnerability in sequelize-cli, published on 5 Jun 2019.
Official description
Versions of sequelize-cli prior to 5.5.0 are vulnerable to Sensitive Data Exposure. The function filteredURL() does not properly sanitize the config.password value which may cause passwords with special characters to be logged in plain text.
Recommendation
Upgrade to version 5.5.0 or later.
Which versions are affected by GHSA-3xc7-xg67-pw99?
2 open source packages ship an affected version, including sequelize-cli.
| Package | Affected | Fixed in |
|---|---|---|
sequelize-cli npm | All versions to 5.4.0 | None |
sequelize-cli npm | All versions to 5.4.0 | None |
How do I fix GHSA-3xc7-xg67-pw99?
No fix has been published for GHSA-3xc7-xg67-pw99 yet. Limit exposure of the affected software until one is available.
Is GHSA-3xc7-xg67-pw99 being exploited?
There is no known exploitation of GHSA-3xc7-xg67-pw99 in the wild and no public exploit code.