{"id":"CVE-2019-1020013","aliases":["EUVD-2019-0584","GHSA-8w3j-g983-8jh5"],"status":"published","title":"Sensitive Data Exposure in parse-server","description":"parse-server before 3.6.0 allows account enumeration.","severity":{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.01155,"percentile":0.67472,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-209"],"published":"2019-07-11T14:23:09Z","modified":"2026-10-20T10:50:38Z","fixes":[{"ecosystem":"npm","package":"parse-server","fixed_in":["3.6.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"parse-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.0"}]}]},{"source":"osv","ecosystem":"npm","package":"parse-server","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.6.0"}]}]}],"products":[{"vendor":"parse","product":"parse-server"},{"vendor":"parse-community","product":"parse-server"},{"vendor":"parseplatform","product":"parse-server"}],"references":[{"url":"https://github.com/parse-community/parse-server/security/advisories/GHSA-8w3j-g983-8jh5","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-1020013","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-8w3j-g983-8jh5","tags":["advisory"]},{"url":"https://snyk.io/vuln/SNYK-JS-PARSESERVER-455637","tags":["web"]},{"url":"https://www.npmjs.com/advisories/1114","tags":["web"]},{"url":"https://github.com/parse-community/parse-server/commit/73b0f9a339b81f5d757725dc557955a7b670a3ec","tags":["web"]},{"url":"https://www.owasp.org/index.php/Testing_for_User_Enumeration_and_Guessable_User_Account_(OWASP-AT-002)#Description_of_the_Issue","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2019-1020013","description":"parse-server before 3.6.0 allows account enumeration.","status":"published","published":"2019-07-29T12:18:07Z","modified":"2024-08-05T03:14:15.223Z","updated_at":"2026-11-02T14:20:18.746972Z"}],"euvd":[{"id":"EUVD-2019-0584","description":"parse-server before 3.6.0 allows account enumeration.","status":"published","published":"2019-07-29T12:18:07Z","modified":"2024-08-05T03:14:15Z","updated_at":"2026-11-03T02:40:18.85013Z"}],"ghsa":[{"id":"GHSA-8w3j-g983-8jh5","title":"Sensitive Data Exposure in parse-server","description":"Versions of parse-server prior to 3.6.0 could allow an account enumeration attack via account linking.\n`ParseError.ACCOUNT_ALREADY_LINKED(208)` was thrown BEFORE the AuthController checks the password and throws a `ParseError.SESSION_MISSING(206)` for Insufficient auth.  An attacker can guess ids and get information about linked accounts/email addresses.\n\n### For more information\nIf you have any questions or comments about this advisory,\nOpen an issue in the [parse-server](https://github.com/parse-community/parse-server)\n[Parse Community Vulnerability Disclosure Program](https://github.com/parse-community/parse-server/blob/master/SECURITY.md)","status":"published","published":"2019-07-11T14:23:09Z","modified":"2023-01-09T05:03:02Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-209"],"updated_at":"2026-11-02T14:36:04.396827Z"}],"nvd":[{"id":"CVE-2019-1020013","description":"parse-server before 3.6.0 allows account enumeration.","status":"published","published":"2019-07-29T13:15:11.903Z","modified":"2026-06-17T02:10:00.82Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-209"],"updated_at":"2026-11-02T14:05:21.892729Z"}],"osv":[{"id":"CVE-2019-1020013","description":"parse-server before 3.6.0 allows account enumeration.","status":"published","published":"2019-07-29T13:15:11.903Z","modified":"2026-10-20T10:50:38.367155105Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:10.383287Z"},{"id":"GHSA-8w3j-g983-8jh5","title":"Sensitive Data Exposure in parse-server","description":"Versions of parse-server prior to 3.6.0 could allow an account enumeration attack via account linking.\n`ParseError.ACCOUNT_ALREADY_LINKED(208)` was thrown BEFORE the AuthController checks the password and throws a `ParseError.SESSION_MISSING(206)` for Insufficient auth.  An attacker can guess ids and get information about linked accounts/email addresses.\n\n### For more information\nIf you have any questions or comments about this advisory,\nOpen an issue in the [parse-server](https://github.com/parse-community/parse-server)\n[Parse Community Vulnerability Disclosure Program](https://github.com/parse-community/parse-server/blob/master/SECURITY.md)","status":"published","published":"2019-07-11T14:23:09Z","modified":"2026-09-10T03:47:50.872302981Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-209"],"updated_at":"2026-11-02T15:46:42.78452Z"}]}}