Parse Server stores password in plain text
Low severity
GitHub Reviewed
Published
Dec 2, 2020
in
parse-community/parse-server
•
Updated Feb 1, 2023
Description
Reviewed
Dec 28, 2020
Published to the GitHub Advisory Database
Dec 28, 2020
Published by the National Vulnerability Database
Dec 30, 2020
Last updated
Feb 1, 2023
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js.
In Parse Server before version 4.5.0, user passwords involved in LDAP authentication are stored in cleartext.
This is fixed in version 4.5.0 by stripping password after authentication to prevent cleartext password storage.
References