Moderate severityNVD Advisory· Published Jul 22, 2020· Updated Aug 4, 2024
Information disclosure through Viewer query in parse-server
CVE-2020-15126
Description
In parser-server from version 3.5.0 and before 4.3.0, an authenticated user using the viewer GraphQL query can by pass all read security on his User object and can also by pass all objects linked via relation or Pointer on his User object.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
parse-servernpm | >= 3.5.0, < 4.3.0 | 4.3.0 |
Affected products
2- Range: >= 3.5.0, < 4.3.0
Patches
Vulnerability mechanics
References
5- github.com/advisories/GHSA-236h-rqv8-8q73ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2020-15126ghsaADVISORY
- github.com/parse-community/parse-server/blob/master/CHANGELOG.mdghsax_refsource_MISCWEB
- github.com/parse-community/parse-server/commit/78239ac9071167fdf243c55ae4bc9a2c0b0d89aaghsax_refsource_MISCWEB
- github.com/parse-community/parse-server/security/advisories/GHSA-236h-rqv8-8q73ghsax_refsource_CONFIRMWEB
News mentions
0No linked articles in our index yet.