Parse Server stores password in plain text

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. It is an npm package "parse-server". In Parse Server before version 4.5.0, user passwords involved in LDAP authentication are stored in cleartext. This is fixed in version 4.5.0 by stripping password after authentication to prevent cleartext password storage.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

敏感数据的明文存储

parse-server 加密问题漏洞

parse-server是一款开源的Backend-as-a-Service（BaaS）框架，它主要用于应用程序后端处理。 Parse Server 4.5.0之前版本存在安全漏洞，该漏洞源于LDAP身份验证涉及的用户密码以明文形式存储。

N/A

N/A