Vulnerabilities > CVE-2020-15126 - Incorrect Authorization vulnerability in Parseplatform Parse Server
Attack vector
NETWORK Attack complexity
LOW Privileges required
LOW Confidentiality impact
HIGH Integrity impact
NONE Availability impact
NONE Summary
In parser-server from version 3.5.0 and before 4.3.0, an authenticated user using the viewer GraphQL query can by pass all read security on his User object and can also by pass all objects linked via relation or Pointer on his User object.
Vulnerable Configurations
| Part | Description | Count |
|---|---|---|
| Application | 1 |
Common Weakness Enumeration (CWE)
References
- https://github.com/parse-community/parse-server/blob/master/CHANGELOG.md#430
- https://github.com/parse-community/parse-server/blob/master/CHANGELOG.md#430
- https://github.com/parse-community/parse-server/commit/78239ac9071167fdf243c55ae4bc9a2c0b0d89aa
- https://github.com/parse-community/parse-server/commit/78239ac9071167fdf243c55ae4bc9a2c0b0d89aa
- https://github.com/parse-community/parse-server/security/advisories/GHSA-236h-rqv8-8q73
- https://github.com/parse-community/parse-server/security/advisories/GHSA-236h-rqv8-8q73