CVE-2020-15126

2020-07-2223:15:11

Google

osv.dev

authenticated user

bypass security

parser-server

graphql query

user object

EPSS

0.001

Percentile

43.0%

JSON

In parser-server from version 3.5.0 and before 4.3.0, an authenticated user using the viewer GraphQL query can by pass all read security on his User object and can also by pass all objects linked via relation or Pointer on his User object.

References

github.com/parse-community/parse-server/blob/master/CHANGELOG.md#430

github.com/parse-community/parse-server/commit/78239ac9071167fdf243c55ae4bc9a2c0b0d89aa

github.com/parse-community/parse-server/security/advisories/GHSA-236h-rqv8-8q73

EPSS

0.001

Percentile

43.0%

JSON

Related for OSV:CVE-2020-15126