search

tsunez / dvna

Damn Vulnerable NodeJS Application
MIT License
0 stars 0 forks source link

CX Security_Misconfiguration @ config/db.js [master] #23

Open tsunez opened 3 years ago

tsunez commented 3 years ago

Security_Misconfiguration issue exists @ config/db.js in branch master

The application takes sensitive, personal data MYSQL_PASSWORD, found at line 3 of config\db.js, and stores it in an unprotected manner, without encryption, to authenticate at line 19 of models\index.js.

Severity: High

CWE:933

Vulnerability details and guidance

Checkmarx

Recommended Fix

Lines: 3

Code (Line #3):

  password: process.env.MYSQL_PASSWORD,
tsunez commented 3 years ago

Issue still exists.

SUMMARY

Issue has 1 vulnerability/vulnerabilities left to be fixed (Please scroll to the top for more information)

tsunez commented 3 years ago

Issue still exists.

SUMMARY

Issue has 1 vulnerability/vulnerabilities left to be fixed (Please scroll to the top for more information)

tsunez commented 3 years ago

Issue still exists.

SUMMARY

Issue has 1 vulnerability/vulnerabilities left to be fixed (Please scroll to the top for more information)

tsunez commented 3 years ago

Issue still exists.

SUMMARY

Issue has 1 vulnerability/vulnerabilities left to be fixed (Please scroll to the top for more information)

tsunez commented 3 years ago

Issue still exists.

SUMMARY

Issue has 1 vulnerability/vulnerabilities left to be fixed (Please scroll to the top for more information)