CVE-2020-26288
published 2020-12-30CVE-2020-26288: Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. It is an npm package "parse-server". In Parse Server…
PriorityP337medium6.5CVSS 3.1
AVNACLPRLUINSUCHINAN
EPSS
0.80%
51.8th percentile
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. It is an npm package "parse-server". In Parse Server before version 4.5.0, user passwords involved in LDAP authentication are stored in cleartext. This is fixed in version 4.5.0 by stripping password after authentication to prevent cleartext password storage.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| parse-community | parse-server | < 4.5.0 | 4.5.0 |
| parse-community | parse-server | >= 0 < 4.5.0 | 4.5.0 |
| parseplatform | parse-server | < 4.5.0 | 4.5.0 |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
nvdv2.04.0MEDIUMAV:N/AC:L/Au:S/C:P/I:N/A:N
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Parse Server stores password in plain text
osv·2020-12-28
CVE-2020-26288 [LOW] Parse Server stores password in plain text
Parse Server stores password in plain text
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js.
In Parse Server before version 4.5.0, user passwords involved in LDAP authentication are stored in cleartext.
This is fixed in version 4.5.0 by stripping password after authentication to prevent cleartext password storage.
GHSA
Parse Server stores password in plain text
ghsa·2020-12-28
CVE-2020-26288 [LOW] CWE-312 Parse Server stores password in plain text
Parse Server stores password in plain text
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js.
In Parse Server before version 4.5.0, user passwords involved in LDAP authentication are stored in cleartext.
This is fixed in version 4.5.0 by stripping password after authentication to prevent cleartext password storage.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/parse-community/parse-server/commit/da905a357d062ab4fea727a21eac231acc2ed92ahttps://github.com/parse-community/parse-server/releases/tag/4.5.0https://github.com/parse-community/parse-server/security/advisories/GHSA-4w46-w44m-3jq3https://www.npmjs.com/package/parse-serverhttps://github.com/parse-community/parse-server/commit/da905a357d062ab4fea727a21eac231acc2ed92ahttps://github.com/parse-community/parse-server/releases/tag/4.5.0https://github.com/parse-community/parse-server/security/advisories/GHSA-4w46-w44m-3jq3https://www.npmjs.com/package/parse-server
2020-12-30
Published