CVE-2020-26288CWE-312

Parse Server stores password in plain text

High · published December 30, 2020

CVSS v3.1
7.7
EPSS
1%
Percentile
56.3
In the wild
Unconfirmed
What it is

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. It is an npm package "parse-server". In Parse Server before version 4.5.0, user passwords involved in LDAP authentication are stored in cleartext. This is fixed in version 4.5.0 by stripping password after authentication to prevent cleartext password storage.

The record
Technical detail
CVSS v3.1
7.7 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00806 · 56.3th percentile
Weakness
CWE-312 · Cleartext Storage of Sensitive Information
Published
2020-12-30T19:25Z
EPSS history
Timeline
  • 30 DEC 19:25Z
    Parse Server stores password in plain text
    cvelistv5