CVE-2020-15270
CVE-2020-15270 · Improper session expiration in Parse Server
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Parse Server (npm package parse-server) broadcasts events to all clients without checking if the session token is valid. This allows clients with expired sessions to still receive subscription objects. It is not possible to create subscription objects with invalid session tokens. The issue is not patched.
CVSS 4.3 · Medium · EPSS 1.2% · Fix available
- Published
- Updated
Stack: node
Affected products and versions
parse-server
- Versions
- <= 4.3.0: Affected
No fix published
parse-server npm
- Affected ranges
- SEMVER: < 4.4.0
Update to 4.4.0