{"id":"GHSA-3xc7-xg67-pw99","summary":"Sensitive Data Exposure in sequelize-cli","details":"Versions of `sequelize-cli` prior to 5.5.0 are vulnerable to Sensitive Data Exposure. The function `filteredURL()` does not properly sanitize the `config.password` value which may cause passwords with special characters to be logged in plain text.\n\n\n## Recommendation\n\nUpgrade to version 5.5.0 or later.","modified":"2021-08-04T20:54:45Z","published":"2019-06-05T20:43:10Z","database_specific":{"github_reviewed":true,"github_reviewed_at":"2019-06-05T20:42:54Z","nvd_published_at":null,"cwe_ids":["CWE-532"],"severity":"LOW"},"references":[{"type":"WEB","url":"https://github.com/sequelize/cli/issues/172"},{"type":"WEB","url":"https://github.com/sequelize/cli/pull/722"},{"type":"WEB","url":"https://github.com/FelixLC/cli/commit/da59652c061a798282e18efad0b6d0afefa15465"},{"type":"WEB","url":"https://snyk.io/vuln/SNYK-JS-SEQUELIZECLI-174320"},{"type":"WEB","url":"https://www.npmjs.com/advisories/825"}],"affected":[{"package":{"name":"sequelize-cli","ecosystem":"npm","purl":"pkg:npm/sequelize-cli"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"5.4.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/06/GHSA-3xc7-xg67-pw99/GHSA-3xc7-xg67-pw99.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N"}]}