Sensitive Data Exposure in parse-server

🗓️ 11 Jul 2019 14:23:09Reported by GitHub Advisory DatabaseType

Sensitive Data Exposure in parse-server versions prior to 3.6.0 which allows account enumeration attack via account linking. ParseError.ACCOUNT_ALREADY_LINKED(208) thrown before password verification, leading to ParseError.SESSION_MISSING(206) for insufficient auth. Allows attacker to guess and obtain information about linked accounts/email addresses.

Reporter	Title	Published	Views	Family All 10
CVE	CVE-2019-1020013	29 Jul 201912:18	–	cve
Cvelist	CVE-2019-1020013	29 Jul 201912:18	–	cvelist
EUVD	EUVD-2019-0584	7 Oct 202500:30	–	euvd
Node.js	Sensitive Data Exposure	12 Aug 201918:47	–	nodejs
NVD	CVE-2019-1020013	29 Jul 201913:15	–	nvd
OSV	GHSA-8W3J-G983-8JH5 Sensitive Data Exposure in parse-server	11 Jul 201914:23	–	osv
Prion	Design/Logic Flaw	29 Jul 201913:15	–	prion
RedhatCVE	CVE-2019-1020013	22 May 202507:52	–	redhatcve
Veracode	Information Disclosure	30 Jul 201904:46	–	veracode
vulnersOsv	@bigegg/parse-server-schema-config (>=1.0.5 <=1.0.10), @peterpme/parse-server-mailgun (>=2.4.8 <=2.5.11) +19 more potentially affected by CVE-2019-1020013 via parse-server (>=2.0.8 <=3.10.0)	11 Jul 201914:23	–	vulnersosv

Vulners

Node

parseplatform parse-serverRange<3.6.0npm

Source	Link
github	www.github.com/parse-community/parse-server/security/advisories/GHSA-8w3j-g983-8jh5
nvd	www.nvd.nist.gov/vuln/detail/CVE-2019-1020013
github	www.github.com/advisories/GHSA-8w3j-g983-8jh5
snyk	www.snyk.io/vuln/SNYK-JS-PARSESERVER-455637
npmjs	www.npmjs.com/advisories/1114
github	www.github.com/parse-community/parse-server/commit/73b0f9a339b81f5d757725dc557955a7b670a3ec
owasp	www.owasp.org/index.php/Testing_for_User_Enumeration_and_Guessable_User_Account_(OWASP-AT-002)

09 Jan 2023 05:03Current

5.3Medium risk

Vulners AI Score5.3

CVSS 25

CVSS 35.3

EPSS0.00232

CWE-209