CVE-2020-15126
CVE-2020-15126 · Information disclosure through Viewer query in parse-server
Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.
In parser-server from version 3.5.0 and before 4.3.0, an authenticated user using the viewer GraphQL query can by pass all read security on his User object and can also by pass all objects linked via relation or Pointer on his User object.
CVSS 6.5 · Moyenne · EPSS 1,1% · Correctif disponible
- Publication
- Mise à jour
Pile logicielle: node
Produits et versions concernés
parse-server
- Versions du logiciel
- >= 3.5.0, < 4.3.0: Concernée
Aucun correctif publié
parse-server npm
- Plages de versions concernées
- SEMVER: ≥ 3.5.0, < 4.3.0
Mettez à jour vers 4.3.0
Sources originales
- https://github.com/parse-community/parse-server/security/advisories/GHSA-236h-rqv8-8q73
- https://github.com/parse-community/parse-server/commit/78239ac9071167fdf243c55ae4bc9a2c0b0d89aa
- https://github.com/parse-community/parse-server/blob/master/CHANGELOG.md#430
- https://nvd.nist.gov/vuln/detail/CVE-2020-15126