Sensitive Data Exposure in sequelize-cli
Summary
GHSA-3xc7-xg67-pw99: Sensitive Data Exposure in sequelize-cli. Affects sequelize-cli versions < 5.4.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The sequelize-cli package is a command-line interface for Sequelize, an Object-Relational Mapping (ORM) tool for Node.js. It provides a set of commands to manage database migrations, models, and configurations. Sequelize is widely used in Node.js applications to interact with relational databases. However, versions prior to 5.5.0 of sequelize-cli are vulnerable to Sensitive Data Exposure.
Vulnerability Detail
The vulnerability in sequelize-cli arises from the filteredURL() function, which fails to properly sanitize the config.password value. As a result, passwords containing special characters may be logged in plain text. This can lead to sensitive data exposure, as the passwords can be accessed by unauthorized individuals who have access to the log files. The vulnerability has a CVSS score of 3.5, indicating a low severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
In conclusion, the sequelize-cli package prior to version 5.5.0 is vulnerable to sensitive data exposure. To mitigate this vulnerability, it is crucial to upgrade to version 5.5.0 or later. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for sequelize-cli →
FAQ
sequelize-cli is a command-line interface for Sequelize, an ORM tool for Node.js. It provides commands to manage database migrations, models, and configurations.
The vulnerability allows passwords with special characters to be logged in plain text, leading to sensitive data exposure. Unauthorized individuals with access to the log files can potentially obtain these passwords.
The vulnerability has a CVSS score of 3.5, indicating a low severity level.
To fix this vulnerability, upgrade to version 5.5.0 or later of sequelize-cli.
No, there is no known workaround for this vulnerability. Upgrading to the fixed version is the recommended solution.
