Parse Server stores password in plain text
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. It is an npm package "parse-server". In Parse Server before version 4.5.0, user passwords involved in LDAP authentication are stored in cleartext. This is fixed in version 4.5.0 by stripping password after authentication to prevent cleartext password storage.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2020-26288US | medium6.5OT erhöht | — | ||
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. It is an npm package "parse-server". In Parse Server before version 4.5.0, u… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://github.com/parse-community/parse-server/commit/da905a357d062ab4fea727a21eac231acc2ed92aADVISORY
- https://github.com/parse-community/parse-server/releases/tag/4.5.0ADVISORY
- https://github.com/parse-community/parse-server/security/advisories/GHSA-4w46-w44m-3jq3ADVISORY
- https://nvd.nist.gov/vuln/detail/CVE-2020-26288WEB
- https://www.npmjs.com/package/parse-serverADVISORY
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan