PT-2019-11629 · Parse · Parse Server

Acinader · Published 2019-07-11 · Updated 2020-08-24 · CVE-2019-1020013

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: parse-server versions prior to 3.6.0

Description: The issue allows for account enumeration. An attacker can guess ids and obtain information about linked accounts or email addresses. This occurs because ParseError.ACCOUNT ALREADY LINKED(208) is thrown before the AuthController checks the password, allowing an attacker to deduce the existence of certain accounts.

Recommendations: For versions prior to 3.6.0, update to version 3.6.0 or later to resolve the issue. As a temporary workaround, consider restricting access to account linking functionality until the update is applied.

Fix

Generation of Error Message Containing Sensitive Information

Weakness Enumeration

CWE-209

Related Identifiers

CVE-2019-1020013

GHSA-8W3J-G983-8JH5

Affected Products

Parse Server

References · 9

• https://github.com/parse-community/parse-server/security/advisories/GHSA-8w3j-g983-8jh5 · Patch
• https://osv.dev/vulnerability/CVE-2019-1020013 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-1020013 · Security Note
• https://osv.dev/vulnerability/GHSA-8w3j-g983-8jh5 · Vendor Advisory
• https://github.com/parse-community/parse-server/commit/73b0f9a339b81f5d757725dc557955a7b670a3ec · Note
• https://npmjs.com/advisories/1114 · Note
• https://snyk.io/vuln/SNYK-JS-PARSESERVER-455637 · Note
• https://owasp.org/index.php/Testing_for_User_Enumeration_and_Guessable_User_Account_(OWASP-AT-002)#Description_of_the_Issue · Note
• https://github.com/advisories/GHSA-8w3j-g983-8jh5 · Note