CVE-2020-26288
CVE-2020-26288 · Parse Server stores password in plain text
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. It is an npm package "parse-server". In Parse Server before version 4.5.0, user passwords involved in LDAP authentication are stored in cleartext. This is fixed in version 4.5.0 by stripping password after authentication to prevent cleartext password storage.
CVSS 7.7 · Alta · EPSS 0,8% · Corrección disponible
- Publicación
- Actualización
Pila tecnológica: node
Productos y versiones afectados
parse-server
- Versiones
- < 4.5.0: Afectada
Sin corrección publicada
parse-server npm
- Intervalos de versiones afectados
- SEMVER: < 4.5.0
Actualiza a 4.5.0
Fuentes originales
- https://github.com/parse-community/parse-server/security/advisories/GHSA-4w46-w44m-3jq3
- https://github.com/parse-community/parse-server/commit/da905a357d062ab4fea727a21eac231acc2ed92a
- https://github.com/parse-community/parse-server/releases/tag/4.5.0
- https://www.npmjs.com/package/parse-server
- https://nvd.nist.gov/vuln/detail/CVE-2020-26288