CVE-2020-26288— Parse Server stores password in plain text

Quick assessment

Copy summary Copy citation

Affected

parse-community parse-server

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

parse-server是一款开源的Backend-as-a-Service（BaaS）框架，它主要用于应用程序后端处理。 Parse Server 4.5.0之前版本存在安全漏洞，该漏洞源于LDAP身份验证涉及的用户密码以明文形式存储。

CVE-2020-26288 affects parse-community parse-server. No confirmed in-the-wild exploitation; assess based on exposure. parse-server是一款开源的Backend-as-a-Service（BaaS）框架，它主要用于应用程序后端处理。 Parse Server 4.5.0之前版本存在安全漏洞，该漏洞源于LDAP身份验证涉及的用户密码以明文形式存储。 CVE-2020-26288 vulnerability details, Shenlong CVE Platform, https://cve.imfht.com/detail/CVE-2020-26288

I. Basic Information for CVE-2020-26288

Affected Products

II. Public POCs for CVE-2020-26288

III. Intelligence Information for CVE-2020-26288

Vendor Advisories for CVE-2020-26288 (1)

• https://github.com/parse-community/parse-server/security/advisories/GHSA-4w46-w44m-3jq3 x_refsource_CONFIRM

Other References for CVE-2020-26288 (2)

• https://www.npmjs.com/package/parse-server x_refsource_MISC
• https://github.com/parse-community/parse-server/releases/tag/4.5.0 x_refsource_MISC

• https://www.cve.org/CVERecord?id=CVE-2020-26288

IV. Related Vulnerabilities

V. Comments for CVE-2020-26288