Sensitive Data Exposure Affecting sequelize-cli package, versions <5.5.0


Severity

Recommended
0.0
low
0
10

CVSS assessment made by Snyk's Security Team. Learn more

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about Sensitive Data Exposure vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDSNYK-JS-SEQUELIZECLI-174320
  • published15 Apr 2019
  • disclosed4 Dec 2018
  • creditFelixLC

Introduced: 4 Dec 2018

CVE NOT AVAILABLE CWE-532  (opens in a new tab)

How to fix?

Upgrade sequelize-cli to version 5.5.0 or higher.

Overview

sequelize-cli is a Command Line Interface (CLI) package version of the Sequelize Object Relational Mapping (ORM) platform.

Affected versions of this package are vulnerable to Sensitive Data Exposure. The filteredUrl function in sequelize-cli does not escape the config.password value, which allows sensitive user information such as passwords to be stored in log files.

CVSS Scores

version 3.1