Lucene search
GoogleOSV:GHSA-236H-RQV8-8Q73HistoryJul 22, 2020 - 11:06 p.m.
GraphQL: Security breach on Viewer query
2020-07-2223:06:47
Google
osv.dev
16
graphql
security breach
viewer query
authenticated user
read security
user object
relation
pointer
patched
parse server 4.3.0.
EPSS
0.001
Percentile
43.0%
Impact
An authenticated user using the viewer GraphQL query can bypass all read security on his User object and can also bypass all objects linked via relation or Pointer on his User object.
Patches
This vulnerability has been patched in Parse Server 4.3.0.
Workarounds
No
References
See commit 78239ac for details.
Related
cvelist
cvelist
CVE-2020-15126 Information disclosure through Viewer query in parse-server
2020-07-22 23:05:19
cve
cve
CVE-2020-15126
2020-07-22 23:15:11
nvd
nvd
CVE-2020-15126
2020-07-22 23:15:11
osv
osv
CVE-2020-15126
2020-07-22 23:15:11
veracode
veracode
Authorization Bypass
2020-07-23 02:01:37
github
github
GraphQL: Security breach on Viewer query
2020-07-22 23:06:47
prion
prion
Design/Logic Flaw
2020-07-22 23:15:00