Vulnerability · Published Jul 22, 2020 · Assigned by GitHub_M
CVE-2020-15126Information disclosure through Viewer query in parse-server
Medium 6.5
In plain English
A medium-severity incorrect authorization in parse-server from parse-community. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 65% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)1.1%top 34.9% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
In parser-server from version 3.5.0 and before 4.3.0, an authenticated user using the viewer GraphQL query can by pass all read security on his User object and can also by pass all objects linked via relation or Pointer on his User object.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | parse-server | 4.3.0 | GHSA-236h-rqv8-8q73 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| parse-community | parse-server | >= 3.5.0, < 4.3.0 |
Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
References
- https://github.com/parse-community/parse-server/security/advisories/GHSA-236h-rqv8-8q73 x_refsource_CONFIRM
- https://github.com/parse-community/parse-server/commit/78239ac9071167fdf243c55ae4bc9a2c0b0d89aa x_refsource_MISC
- https://github.com/parse-community/parse-server/blob/master/CHANGELOG.md#430 x_refsource_MISC