CVEvulnerability
CVE-2020-15270
4.3 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2020-10-22
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 4.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- CVSS 3.1 ([email protected])
- 4.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- CVSS 2.0 ([email protected])
- 4.0 MEDIUM — AV:N/AC:L/Au:S/C:P/I:N/A:N
- Weaknesses
- CWE-672
Description
Parse Server (npm package parse-server) broadcasts events to all clients without checking if the session token is valid. This allows clients with expired sessions to still receive subscription objects. It is not possible to create subscription objects with invalid session tokens. The issue is not patched.
Affected configurations
• parseplatform parse-server (<= 4.3.0)
Related
Weakness · CWE (1)
- CWE-672 Operation on a Resource after Expiration or Release weakness
References
- https://github.com/parse-community/parse-server/commit/78b59fb26b1c36e3cdbd42ba9fec025003267f58 Patch, Third Party Advisory
- https://github.com/parse-community/parse-server/security/advisories/GHSA-2xm2-xj2q-qgpj Third Party Advisory
- https://npmjs.com/parse-server Product, Third Party Advisory
- https://github.com/parse-community/parse-server/commit/78b59fb26b1c36e3cdbd42ba9fec025003267f58 Patch, Third Party Advisory
- https://github.com/parse-community/parse-server/security/advisories/GHSA-2xm2-xj2q-qgpj Third Party Advisory
- https://npmjs.com/parse-server Product, Third Party Advisory