CVE-2020-15126
CVE-2020-15126 · Information disclosure through Viewer query in parse-server
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
In parser-server from version 3.5.0 and before 4.3.0, an authenticated user using the viewer GraphQL query can by pass all read security on his User object and can also by pass all objects linked via relation or Pointer on his User object.
CVSS 6.5 · Media · EPSS 1,1% · Corrección disponible
- Publicación
- Actualización
Pila tecnológica: node
Productos y versiones afectados
parse-server
- Versiones
- >= 3.5.0, < 4.3.0: Afectada
Sin corrección publicada
parse-server npm
- Intervalos de versiones afectados
- SEMVER: ≥ 3.5.0, < 4.3.0
Actualiza a 4.3.0
Fuentes originales
- https://github.com/parse-community/parse-server/security/advisories/GHSA-236h-rqv8-8q73
- https://github.com/parse-community/parse-server/commit/78239ac9071167fdf243c55ae4bc9a2c0b0d89aa
- https://github.com/parse-community/parse-server/blob/master/CHANGELOG.md#430
- https://nvd.nist.gov/vuln/detail/CVE-2020-15126