CVE-2020-15126
CVE-2020-15126 · Information disclosure through Viewer query in parse-server
This page contains facts from public vulnerability sources. Check the original advisory before updating.
In parser-server from version 3.5.0 and before 4.3.0, an authenticated user using the viewer GraphQL query can by pass all read security on his User object and can also by pass all objects linked via relation or Pointer on his User object.
CVSS 6.5 · Medium · EPSS 1.1% · Fix available
- Published
- Updated
Stack: node
Affected products and versions
parse-server
- Versions
- >= 3.5.0, < 4.3.0: Affected
No fix published
parse-server npm
- Affected ranges
- SEMVER: ≥ 3.5.0, < 4.3.0
Update to 4.3.0
Original sources
- https://github.com/parse-community/parse-server/security/advisories/GHSA-236h-rqv8-8q73
- https://github.com/parse-community/parse-server/commit/78239ac9071167fdf243c55ae4bc9a2c0b0d89aa
- https://github.com/parse-community/parse-server/blob/master/CHANGELOG.md#430
- https://nvd.nist.gov/vuln/detail/CVE-2020-15126