What is CVE-2020-26288?

CVE-2020-26288 is a vulnerability in Parse Server before version 4.5.0 that allows user passwords involved in LDAP authentication to be stored in cleartext.

What is the severity of CVE-2020-26288?

The severity of CVE-2020-26288 is high, with a CVSS score of 6.5.

How does CVE-2020-26288 affect Parse Server?

CVE-2020-26288 affects Parse Server versions before 4.5.0, where user passwords involved in LDAP authentication are stored in cleartext.

How can I fix CVE-2020-26288?

To fix CVE-2020-26288, upgrade to Parse Server version 4.5.0 or later, where this vulnerability is fixed.

Where can I find more information about CVE-2020-26288?

You can find more information about CVE-2020-26288 at the following references: [link](https://github.com/parse-community/parse-server/commit/da905a357d062ab4fea727a21eac231acc2ed92a), [link](https://github.com/parse-community/parse-server/releases/tag/4.5.0), [link](https://github.com/parse-community/parse-server/security/advisories/GHSA-4w46-w44m-3jq3).

Vulnerability/
CVE-2020-26288

high

7.7

CWE

312

30/12/2020

4/8/2024

CVE-2020-26288: Parse Server stores password in plain text

First published: Wed Dec 30 2020(Updated: )

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. It is an npm package "parse-server". In Parse Server before version 4.5.0, user passwords involved in LDAP authentication are stored in cleartext. This is fixed in version 4.5.0 by stripping password after authentication to prevent cleartext password storage.

Credit: security-advisories@github.com

Affected Software	Affected Version	How to fix
Parseplatform Parse-server	<4.5.0

Remedy

https://github.com/parse-community/parse-server/commit/da905a357d062ab4fea727a21eac231acc2ed92a

Never miss a vulnerability like this again

Reference Links

Frequently Asked Questions

What is CVE-2020-26288?
CVE-2020-26288 is a vulnerability in Parse Server before version 4.5.0 that allows user passwords involved in LDAP authentication to be stored in cleartext.
What is the severity of CVE-2020-26288?
The severity of CVE-2020-26288 is high, with a CVSS score of 6.5.
How does CVE-2020-26288 affect Parse Server?
CVE-2020-26288 affects Parse Server versions before 4.5.0, where user passwords involved in LDAP authentication are stored in cleartext.
How can I fix CVE-2020-26288?
To fix CVE-2020-26288, upgrade to Parse Server version 4.5.0 or later, where this vulnerability is fixed.
Where can I find more information about CVE-2020-26288?
You can find more information about CVE-2020-26288 at the following references: [link](https://github.com/parse-community/parse-server/commit/da905a357d062ab4fea727a21eac231acc2ed92a), [link](https://github.com/parse-community/parse-server/releases/tag/4.5.0), [link](https://github.com/parse-community/parse-server/security/advisories/GHSA-4w46-w44m-3jq3).

collector/nvd-index
agent/references
agent/type
agent/softwarecombine
collector/mitre-cve
source/MITRE
agent/last-modified-date
agent/severity
agent/weakness
agent/remedy
agent/title
agent/author
agent/tags
agent/first-publish-date
agent/event
agent/description
vendor/parseplatform
canonical/parseplatform parse-server

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.