CVE-2020-26288

Katalog CVE

CVSS 6.5 · Medium EPSS 0,81%

Kerentanan Cleartext Storage of Sensitive Information pada parseplatform parse-server. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. It is an npm package "parse-server". In Parse Server before version 4.5.0, user passwords involved in LDAP authentication are stored in cleartext. This is fixed in version 4.5.0 by stripping password after authentication to prevent cleartext password storage.

Rincian

Terbit di NVD

30 Desember 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-312: Cleartext Storage of Sensitive Information

EPSS (30 hari)

0,81% peluang dieksploitasi; lebih tinggi dari 55,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/parse-community/parse-server/commit/da905a357d062ab4fea727a21eac231acc2ed92a patch · advisory pihak ketiga
• https://github.com/parse-community/parse-server/releases/tag/4.5.0 release notes · advisory pihak ketiga
• https://github.com/parse-community/parse-server/security/advisories/GHSA-4w46-w44m-3jq3 advisory pihak ketiga
• https://www.npmjs.com/package/parse-server product · advisory pihak ketiga