GitHub Advisoryadvisory · npm

GHSA-4w46-w44m-3jq3 Parse Server stores password in plain text

LOW Published 2020-12-28 Modified 2021-01-07 Official page ↗
Aliases
CVE-2020-26288
Ecosystem
npm
Packages
parse-server
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Weaknesses
CWE-312
Reviewed
2020-12-28

Affected packages

• npm parse-server: < 4.5.0 → fixed in 4.5.0

Description

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In Parse Server before version 4.5.0, user passwords involved in LDAP authentication are stored in cleartext. This is fixed in version 4.5.0 by stripping password after authentication to prevent cleartext password storage.

Related

Alias · CVE (1)

  • CVE-2020-26288 Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. vulnerability

Weakness · CWE (1)

  • CWE-312 Cleartext Storage of Sensitive Information weakness

References