CVE-2023-6460

Published: Dec 4, 2023Modified: Jun 17, 2026

5.5

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 1.8 / Impact: 3.6

Source: NVD

Description

A potential logging of the firestore key via logging within nodejs-firestore exists - Developers who were logging objects through this._settings would be logging the firestore key as well potentially exposing it to anyone with logs read access. We recommend upgrading to version 6.1.0 to avoid this issue

Affected (1)

Products: Google: Cloud Firestore

1 product

Cloud Firestore

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Google Cloud Firestore	Before 6.1.0

Related CWEs

Insertion of Sensitive Information into Log File

Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.

Insecure Storage of Sensitive Information

The product stores sensitive information without properly limiting read or write access by unauthorized actors.

References (3)

https://bughunters.google.com/reports/vrp/KNvgo1Wij

Source: cve-coordination@google.com

https://github.com/googleapis/nodejs-firestore/pull/1742

Source: cve-coordination@google.com

Issue TrackingPatch

https://github.com/googleapis/nodejs-firestore/pull/1742

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingPatch

Timeline

No history available yet.