GitHub Advisoryadvisory · npm

GHSA-236h-rqv8-8q73 GraphQL: Security breach on Viewer query

MEDIUM Published 2020-07-22 Modified 2023-10-26 Official page ↗
Aliases
CVE-2020-15126
Ecosystem
npm
Packages
parse-server
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-863
Reviewed
2020-07-22

Affected packages

• npm parse-server: >= 3.5.0, < 4.3.0 → fixed in 4.3.0

Description

Impact An authenticated user using the viewer GraphQL query can bypass all read security on his User object and can also bypass all objects linked via relation or Pointer on his User object. Patches This vulnerability has been patched in Parse Server 4.3.0. Workarounds No References See commit 78239ac for details.

Related

Alias · CVE (1)

  • CVE-2020-15126 In parser-server from version 3.5.0 and before 4.3.0, an authenticated user using the viewer GraphQL query can by pass all read security on… vulnerability

Weakness · CWE (1)

  • CWE-863 Incorrect Authorization weakness

References