PT-2019-11629 · Parse · Parse Server

Acinader · Publicado 2019-07-11 · Atualizado 2020-08-24 · CVE-2019-1020013

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: parse-server versions prior to 3.6.0

Description: The issue allows for account enumeration. An attacker can guess ids and obtain information about linked accounts or email addresses. This occurs because ParseError.ACCOUNT ALREADY LINKED(208) is thrown before the AuthController checks the password, allowing an attacker to deduce the existence of certain accounts.

Recommendations: For versions prior to 3.6.0, update to version 3.6.0 or later to resolve the issue. As a temporary workaround, consider restricting access to account linking functionality until the update is applied.

Correção

Generation of Error Message Containing Sensitive Information

Enumeração de Fraquezas

CWE-209

Identificadores relacionados

CVE-2019-1020013

GHSA-8W3J-G983-8JH5

Produtos afetados

Parse Server

Referências · 9

• https://github.com/parse-community/parse-server/security/advisories/GHSA-8w3j-g983-8jh5 · Correção
• https://github.com/parse-community/parse-server/commit/73b0f9a339b81f5d757725dc557955a7b670a3ec · Nota
• https://npmjs.com/advisories/1114 · Nota
• https://osv.dev/vulnerability/CVE-2019-1020013 · Aviso do Fabricante
• https://snyk.io/vuln/SNYK-JS-PARSESERVER-455637 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-1020013 · Nota de Segurança
• https://owasp.org/index.php/Testing_for_User_Enumeration_and_Guessable_User_Account_(OWASP-AT-002)#Description_of_the_Issue · Nota
• https://github.com/advisories/GHSA-8w3j-g983-8jh5 · Nota
• https://osv.dev/vulnerability/GHSA-8w3j-g983-8jh5 · Aviso do Fabricante