CVEvulnerability
CVE-2020-26288
6.5 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2020-12-30
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 7.7 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
- CVSS 3.1 ([email protected])
- 6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- CVSS 2.0 ([email protected])
- 4.0 MEDIUM — AV:N/AC:L/Au:S/C:P/I:N/A:N
- Weaknesses
- CWE-312
Description
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. It is an npm package "parse-server". In Parse Server before version 4.5.0, user passwords involved in LDAP authentication are stored in cleartext. This is fixed in version 4.5.0 by stripping password after authentication to prevent cleartext password storage.
Affected configurations
• parseplatform parse-server (< 4.5.0)
Related
Weakness · CWE (1)
- CWE-312 Cleartext Storage of Sensitive Information weakness
References
- https://github.com/parse-community/parse-server/commit/da905a357d062ab4fea727a21eac231acc2ed92a Patch, Third Party Advisory
- https://github.com/parse-community/parse-server/releases/tag/4.5.0 Release Notes, Third Party Advisory
- https://github.com/parse-community/parse-server/security/advisories/GHSA-4w46-w44m-3jq3 Third Party Advisory
- https://www.npmjs.com/package/parse-server Product, Third Party Advisory
- https://github.com/parse-community/parse-server/commit/da905a357d062ab4fea727a21eac231acc2ed92a Patch, Third Party Advisory
- https://github.com/parse-community/parse-server/releases/tag/4.5.0 Release Notes, Third Party Advisory
- https://github.com/parse-community/parse-server/security/advisories/GHSA-4w46-w44m-3jq3 Third Party Advisory
- https://www.npmjs.com/package/parse-server Product, Third Party Advisory