EPSS
Percentile
30.9%
parse-server is vulnerable to information disclosure. An insecure regular expression parsing of the _sessionToken and token[$regex] variables allows an attacker to discover and retrieve valid accounts, or verify and reset another user’s account.
_sessionToken
token[$regex]
github.com/advisories/GHSA-h4mf-75hf-67w4
github.com/parse-community/parse-server/commit/3a3a5eee5ffa48da1352423312cb767de14de269
github.com/parse-community/parse-server/security/advisories/GHSA-h4mf-75hf-67w4