CVE-2020-26288: Parse Server stores password in plain text
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. It is an npm package "parse-server". In Parse Server before version 4.5.0, user passwords involved in LDAP authentication are stored in cleartext. This is fixed in version 4.5.0 by stripping password after authentication to prevent cleartext password storage.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2020-26288?
CVE-2020-26288 is a vulnerability in Parse Server before version 4.5.0 that allows user passwords involved in LDAP authentication to be stored in cleartext.
What is the severity of CVE-2020-26288?
The severity of CVE-2020-26288 is high, with a CVSS score of 6.5.
How does CVE-2020-26288 affect Parse Server?
CVE-2020-26288 affects Parse Server versions before 4.5.0, where user passwords involved in LDAP authentication are stored in cleartext.
How can I fix CVE-2020-26288?
To fix CVE-2020-26288, upgrade to Parse Server version 4.5.0 or later, where this vulnerability is fixed.
Where can I find more information about CVE-2020-26288?
You can find more information about CVE-2020-26288 at the following references: [link](https://github.com/parse-community/parse-server/commit/da905a357d062ab4fea727a21eac231acc2ed92a), [link](https://github.com/parse-community/parse-server/releases/tag/4.5.0), [link](https://github.com/parse-community/parse-server/security/advisories/GHSA-4w46-w44m-3jq3).