GHSA-p77h-hv6g-fmfp: 
JavaScript vulnerability analysis and mitigation

A sensitive data exposure vulnerability was identified in ibm_db versions prior to 2.6.0. The vulnerability was discovered on August 12, 2019, and publicly disclosed on September 3, 2020. The issue affects the ibm_db package, which provides an asynchronous/synchronous interface for node.js to IBM DB2 and IBM Informix databases (GitHub Advisory, Snyk Report).

The vulnerability has been assigned a CVSS v3.1 score of 5.0 (Moderate severity) with the following metrics: Attack Vector: Local, Attack Complexity: Low, Privileges Required: Low, User Interaction: Required, Scope: Unchanged, Confidentiality: High, Integrity: None, Availability: None. The technical issue stems from the package printing database credentials in plaintext in logs while in debug mode (GitHub Advisory).

The vulnerability could lead to exposure of sensitive database credentials when debug logging is enabled. This could result in unauthorized access to database systems if the logged credentials are intercepted by malicious actors. The impact primarily affects the confidentiality of the system, with potential for total loss of confidentiality of the affected component (Snyk Report).

The vulnerability requires local access to the system and user interaction to be exploited. An attacker would need access to the application logs when debug mode is enabled to obtain the exposed credentials (GitHub Advisory).

Users are recommended to upgrade to ibm_db version 2.6.0 or later, which contains the fix for this vulnerability. Additionally, users should ensure that no sensitive information was logged in their debug logs prior to the upgrade (GitHub Advisory).