CVE-2020-15126CWE-863

Information disclosure through Viewer query in parse-server

Medium · published July 22, 2020

CVSS v3.1
6.5
EPSS
1%
Percentile
64.6
In the wild
Unconfirmed
What it is

In parser-server from version 3.5.0 and before 4.3.0, an authenticated user using the viewer GraphQL query can by pass all read security on his User object and can also by pass all objects linked via relation or Pointer on his User object.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.01072 · 64.6th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2020-07-22T23:05Z
EPSS history
Timeline
  • 22 JUL 23:05Z
    Information disclosure through Viewer query in parse-server
    cvelistv5