Description
The setPassword method (http://parseplatform.org/Parse-SDK-JS/api/2.9.1/Parse.User.html#setPassword) stores the user’s password in localStorage as raw text making it vulnerable to anyone with access to your localStorage. We believe this is the only time that password is stored at all.
Recommendation
Update the parse package to the latest compatible version. Followings are version details:
- Affected version(s): < 2.10.0
- Patched version(s): 2.10.0
References
Could your website be exposed too?
SmartScanner can check your website for Storing Password in Local Storage and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Sveltejs devalue's `devalue.parse` and `devalue.unflatten` emit objects with `__proto__` own properties - Vulnerability
- obsidian-local-rest-api: Authenticated path traversal via URL-encoded %2F in /vault/{path} — arbitrary host file read/wr - Vulnerability
- Gatsby develop server has Local File Inclusion vulnerability - CVE-2023-34238
- Insecure password handling vulnerability in Strapi - CVE-2021-46440
You might also like:
See something that needs correcting? Let us knowUpdated January 09, 2023