Detections
Analytics

Firebase Configuration Detected

high Web App Scanning Plugin ID 115124

Language:

Synopsis

Firebase Configuration Detected

Description

Firebase is a platform developed by Google for creating mobile and web applications. It provides various services, including real-time databases, authentication, and hosting.

This plugin checks for the presence of Firebase configuration files in web applications. These files often contain sensitive information such as API keys, project IDs, and other configuration details that could be exploited by attackers if exposed publicly.

Solution

Ensure that the firebase configuration file is not deployed with the application or, at least, is not exposed in a web server directory by setting proper permissions on it. If sensitive information like credentials are leaked in the exposed file, they should be revoked and reset on the affected assets.

See Also

https://firebase.google.com/

Plugin Details

Severity: High

ID: 115124

Type: remote

Published: 1/30/2026

Updated: 1/30/2026

Scan Template: api, basic, full, pci, scan

Risk Information

VPR

Risk Factor: Low

Score: 3.6

CVSS v2

Risk Factor: High

Base Score: 7.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:N

CVSS Score Source: Tenable

CVSS v3

Risk Factor: High

Base Score: 7.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CVSS Score Source: Tenable

CVSS v4

Risk Factor: High

Base Score: 8.7

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

CVSS Score Source: Tenable

Reference Information